SB20250828109 - Red Hat Enterprise Linux 9 update for httpd
Published: August 28, 2025 Updated: January 4, 2026
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 3 secuirty vulnerabilities.
1) Improper Encoding or Escaping of Output (CVE-ID: CVE-2024-47252)
The vulnerability allows a remote attacker to manipulate data in log files.
The vulnerability exists due to improper input validation in mod_ssl. In a logging configuration where CustomLog is used with "%{varname}x" or "%{varname}c" to log variables provided by mod_ssl such as SSL_TLS_SNI, no escaping is performed by either mod_log_config or mod_ssl and unsanitized data provided by the client may appear in log files. A remote attacker can manipulate contents of log files.
2) Security features bypass (CVE-ID: CVE-2025-23048)
The vulnerability allows a remote attacker to bypass implemented security restrictions.
The vulnerability exists due to access control bypass with session resumption in mod_ssl. A remote attacker can use the TLS 1.3 session resumption to bypass implemented access control.
Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
3) Cryptographic issues (CVE-ID: CVE-2025-49812)
The vulnerability allows a remote attacker to perform MitM attack.
The vulnerability exists due to he way certain mod_ssl configurations handle TLS upgrades. A remote attacker can launch an HTTP desynchronisation attack, which allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.
Note, only configurations using "SSLEngine optional" to enable TLS upgrades are affected.
Remediation
Install update from vendor's website.