ALSA-2025:15095

See a problem?
Please try reporting it to the source first.

Source

https://errata.almalinux.org/10/ALSA-2025-15095.html

Import Source

https://github.com/AlmaLinux/osv-database/blob/master/advisories/almalinux10/ALSA-2025:15095.json

JSON Data

https://api.test.osv.dev/v1/vulns/ALSA-2025:15095

Related

Published

2025-09-02T00:00:00Z

Modified

2025-09-03T08:58:52Z

Summary

Moderate: httpd security update

Details

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252)
httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048)
httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References

Affected packages

AlmaLinux:10 / httpd

Package

Name: httpd
Purl: pkg:rpm/almalinux/httpd

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / httpd-core

Package

Name: httpd-core
Purl: pkg:rpm/almalinux/httpd-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / httpd-devel

Package

Name: httpd-devel
Purl: pkg:rpm/almalinux/httpd-devel

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / httpd-filesystem

Package

Name: httpd-filesystem
Purl: pkg:rpm/almalinux/httpd-filesystem

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / httpd-manual

Package

Name: httpd-manual
Purl: pkg:rpm/almalinux/httpd-manual

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / httpd-tools

Package

Name: httpd-tools
Purl: pkg:rpm/almalinux/httpd-tools

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / mod_ldap

Package

Name: mod_ldap
Purl: pkg:rpm/almalinux/mod_ldap

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / mod_lua

Package

Name: mod_lua
Purl: pkg:rpm/almalinux/mod_lua

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / mod_proxy_html

Package

Name: mod_proxy_html
Purl: pkg:rpm/almalinux/mod_proxy_html

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:2.4.63-1.el10_0.2

AlmaLinux:10 / mod_session

Package

Name: mod_session
Purl: pkg:rpm/almalinux/mod_session

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1.el10_0.2

AlmaLinux:10 / mod_ssl

Package

Name: mod_ssl
Purl: pkg:rpm/almalinux/mod_ssl

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1:2.4.63-1.el10_0.2