{"schema_version":"1.7.2","id":"OESA-2025-2171","modified":"2025-09-05T12:43:08Z","published":"2025-09-05T12:43:08Z","upstream":["CVE-2024-42516","CVE-2024-43204","CVE-2024-47252","CVE-2025-23048","CVE-2025-49812"],"summary":"httpd security update","details":"Apache HTTP Server is a powerful and flexible HTTP/1.1 compliant web server.\r\n\r\nSecurity Fix(es):\n\nHTTP response splitting in the core of Apache HTTP Server allows an attacker who can manipulate the Content-Type response headers of applications hosted or proxied by the server can split the HTTP response.\n\nThis vulnerability was described as CVE-2023-38709 but the patch included in Apache HTTP Server 2.4.59 did not address the issue.\n\nUsers are recommended to upgrade to version 2.4.64, which fixes this issue.(CVE-2024-42516)\n\nSSRF in Apache HTTP Server with mod_proxy loaded allows an attacker to send outbound proxy requests to a URL controlled by the attacker.  Requires an unlikely configuration where mod_headers is configured to modify the Content-Type request or response header with a value provided in the HTTP request.\n\nUsers are recommended to upgrade to version 2.4.64 which fixes this issue.(CVE-2024-43204)\n\nInsufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.\n\nIn a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.(CVE-2024-47252)\n\nIn some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.\n\nConfigurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.(CVE-2025-23048)\n\nIn some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.\n\nOnly configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.(CVE-2025-49812)","affected":[{"package":{"ecosystem":"openEuler:24.03-LTS-SP1","name":"httpd","purl":"pkg:rpm/openEuler/httpd&distro=openEuler-24.03-LTS-SP1"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.58-10.oe2403sp1"}]}],"ecosystem_specific":{"aarch64":["httpd-2.4.58-10.oe2403sp1.aarch64.rpm","httpd-debuginfo-2.4.58-10.oe2403sp1.aarch64.rpm","httpd-debugsource-2.4.58-10.oe2403sp1.aarch64.rpm","httpd-devel-2.4.58-10.oe2403sp1.aarch64.rpm","httpd-tools-2.4.58-10.oe2403sp1.aarch64.rpm","mod_ldap-2.4.58-10.oe2403sp1.aarch64.rpm","mod_md-2.4.58-10.oe2403sp1.aarch64.rpm","mod_proxy_html-2.4.58-10.oe2403sp1.aarch64.rpm","mod_session-2.4.58-10.oe2403sp1.aarch64.rpm","mod_ssl-2.4.58-10.oe2403sp1.aarch64.rpm"],"noarch":["httpd-filesystem-2.4.58-10.oe2403sp1.noarch.rpm","httpd-help-2.4.58-10.oe2403sp1.noarch.rpm"],"src":["httpd-2.4.58-10.oe2403sp1.src.rpm"],"x86_64":["httpd-2.4.58-10.oe2403sp1.x86_64.rpm","httpd-debuginfo-2.4.58-10.oe2403sp1.x86_64.rpm","httpd-debugsource-2.4.58-10.oe2403sp1.x86_64.rpm","httpd-devel-2.4.58-10.oe2403sp1.x86_64.rpm","httpd-tools-2.4.58-10.oe2403sp1.x86_64.rpm","mod_ldap-2.4.58-10.oe2403sp1.x86_64.rpm","mod_md-2.4.58-10.oe2403sp1.x86_64.rpm","mod_proxy_html-2.4.58-10.oe2403sp1.x86_64.rpm","mod_session-2.4.58-10.oe2403sp1.x86_64.rpm","mod_ssl-2.4.58-10.oe2403sp1.x86_64.rpm"]}}],"references":[{"type":"ADVISORY","url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2171"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-42516"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-43204"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47252"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23048"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49812"}],"database_specific":{"severity":"Critical"}}