AZL-65172
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-65172.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-65172
- Upstream
- Published
- 2025-07-10T17:15:46Z
- Modified
- 2026-04-01T05:20:52Z
- Summary
- CVE-2024-47252 affecting package httpd for versions less than 2.4.64-1
- Details
-
Insufficient escaping of user-supplied data in mod_ssl in Apache HTTP Server 2.4.63 and earlier allows an untrusted SSL/TLS client to insert escape characters into log files in some configurations.
In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files.
- References