RLSA-2025:15023

Synopsis

Moderate: httpd security update

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

* httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252)

* httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048)

* httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected products

Rocky Linux 9.6 aarch64 Rocky Linux 9.6 ppc64le Rocky Linux 9.6 s390x Rocky Linux 9.6 x86_64

Fixes

2374571 2374576 2374580

CVEs

CVE-2024-47252 CVE-2025-23048 CVE-2025-49812

Affected packages

Rocky Linux 9.6 aarch64 - AppStream

httpd-0:2.4.62-4.el9_6.4.aarch64.rpm httpd-0:2.4.62-4.el9_6.4.src.rpm httpd-core-0:2.4.62-4.el9_6.4.aarch64.rpm httpd-core-debuginfo-0:2.4.62-4.el9_6.4.aarch64.rpm httpd-debuginfo-0:2.4.62-4.el9_6.4.aarch64.rpm httpd-debugsource-0:2.4.62-4.el9_6.4.aarch64.rpm httpd-devel-0:2.4.62-4.el9_6.4.aarch64.rpm httpd-filesystem-0:2.4.62-4.el9_6.4.noarch.rpm httpd-manual-0:2.4.62-4.el9_6.4.noarch.rpm httpd-tools-0:2.4.62-4.el9_6.4.aarch64.rpm httpd-tools-debuginfo-0:2.4.62-4.el9_6.4.aarch64.rpm mod_ldap-0:2.4.62-4.el9_6.4.aarch64.rpm mod_ldap-debuginfo-0:2.4.62-4.el9_6.4.aarch64.rpm mod_lua-0:2.4.62-4.el9_6.4.aarch64.rpm mod_lua-debuginfo-0:2.4.62-4.el9_6.4.aarch64.rpm mod_proxy_html-1:2.4.62-4.el9_6.4.aarch64.rpm mod_proxy_html-debuginfo-1:2.4.62-4.el9_6.4.aarch64.rpm mod_session-0:2.4.62-4.el9_6.4.aarch64.rpm mod_session-debuginfo-0:2.4.62-4.el9_6.4.aarch64.rpm mod_ssl-1:2.4.62-4.el9_6.4.aarch64.rpm mod_ssl-debuginfo-1:2.4.62-4.el9_6.4.aarch64.rpm

Rocky Linux 9.6 ppc64le - AppStream

httpd-0:2.4.62-4.el9_6.4.ppc64le.rpm httpd-0:2.4.62-4.el9_6.4.src.rpm httpd-core-0:2.4.62-4.el9_6.4.ppc64le.rpm httpd-core-debuginfo-0:2.4.62-4.el9_6.4.ppc64le.rpm httpd-debuginfo-0:2.4.62-4.el9_6.4.ppc64le.rpm httpd-debugsource-0:2.4.62-4.el9_6.4.ppc64le.rpm httpd-devel-0:2.4.62-4.el9_6.4.ppc64le.rpm httpd-filesystem-0:2.4.62-4.el9_6.4.noarch.rpm httpd-manual-0:2.4.62-4.el9_6.4.noarch.rpm httpd-tools-0:2.4.62-4.el9_6.4.ppc64le.rpm httpd-tools-debuginfo-0:2.4.62-4.el9_6.4.ppc64le.rpm mod_ldap-0:2.4.62-4.el9_6.4.ppc64le.rpm mod_ldap-debuginfo-0:2.4.62-4.el9_6.4.ppc64le.rpm mod_lua-0:2.4.62-4.el9_6.4.ppc64le.rpm mod_lua-debuginfo-0:2.4.62-4.el9_6.4.ppc64le.rpm mod_proxy_html-1:2.4.62-4.el9_6.4.ppc64le.rpm mod_proxy_html-debuginfo-1:2.4.62-4.el9_6.4.ppc64le.rpm mod_session-0:2.4.62-4.el9_6.4.ppc64le.rpm mod_session-debuginfo-0:2.4.62-4.el9_6.4.ppc64le.rpm mod_ssl-1:2.4.62-4.el9_6.4.ppc64le.rpm mod_ssl-debuginfo-1:2.4.62-4.el9_6.4.ppc64le.rpm

Rocky Linux 9.6 s390x - AppStream

httpd-0:2.4.62-4.el9_6.4.s390x.rpm httpd-0:2.4.62-4.el9_6.4.src.rpm httpd-core-0:2.4.62-4.el9_6.4.s390x.rpm httpd-core-debuginfo-0:2.4.62-4.el9_6.4.s390x.rpm httpd-debuginfo-0:2.4.62-4.el9_6.4.s390x.rpm httpd-debugsource-0:2.4.62-4.el9_6.4.s390x.rpm httpd-devel-0:2.4.62-4.el9_6.4.s390x.rpm httpd-filesystem-0:2.4.62-4.el9_6.4.noarch.rpm httpd-manual-0:2.4.62-4.el9_6.4.noarch.rpm httpd-tools-0:2.4.62-4.el9_6.4.s390x.rpm httpd-tools-debuginfo-0:2.4.62-4.el9_6.4.s390x.rpm mod_ldap-0:2.4.62-4.el9_6.4.s390x.rpm mod_ldap-debuginfo-0:2.4.62-4.el9_6.4.s390x.rpm mod_lua-0:2.4.62-4.el9_6.4.s390x.rpm mod_lua-debuginfo-0:2.4.62-4.el9_6.4.s390x.rpm mod_proxy_html-1:2.4.62-4.el9_6.4.s390x.rpm mod_proxy_html-debuginfo-1:2.4.62-4.el9_6.4.s390x.rpm mod_session-0:2.4.62-4.el9_6.4.s390x.rpm mod_session-debuginfo-0:2.4.62-4.el9_6.4.s390x.rpm mod_ssl-1:2.4.62-4.el9_6.4.s390x.rpm mod_ssl-debuginfo-1:2.4.62-4.el9_6.4.s390x.rpm

Rocky Linux 9.6 x86_64 - AppStream

httpd-0:2.4.62-4.el9_6.4.src.rpm httpd-0:2.4.62-4.el9_6.4.x86_64.rpm httpd-core-0:2.4.62-4.el9_6.4.x86_64.rpm httpd-core-debuginfo-0:2.4.62-4.el9_6.4.x86_64.rpm httpd-debuginfo-0:2.4.62-4.el9_6.4.x86_64.rpm httpd-debugsource-0:2.4.62-4.el9_6.4.x86_64.rpm httpd-devel-0:2.4.62-4.el9_6.4.x86_64.rpm httpd-filesystem-0:2.4.62-4.el9_6.4.noarch.rpm httpd-manual-0:2.4.62-4.el9_6.4.noarch.rpm httpd-tools-0:2.4.62-4.el9_6.4.x86_64.rpm httpd-tools-debuginfo-0:2.4.62-4.el9_6.4.x86_64.rpm mod_ldap-0:2.4.62-4.el9_6.4.x86_64.rpm mod_ldap-debuginfo-0:2.4.62-4.el9_6.4.x86_64.rpm mod_lua-0:2.4.62-4.el9_6.4.x86_64.rpm mod_lua-debuginfo-0:2.4.62-4.el9_6.4.x86_64.rpm mod_proxy_html-1:2.4.62-4.el9_6.4.x86_64.rpm mod_proxy_html-debuginfo-1:2.4.62-4.el9_6.4.x86_64.rpm mod_session-0:2.4.62-4.el9_6.4.x86_64.rpm mod_session-debuginfo-0:2.4.62-4.el9_6.4.x86_64.rpm mod_ssl-1:2.4.62-4.el9_6.4.x86_64.rpm mod_ssl-debuginfo-1:2.4.62-4.el9_6.4.x86_64.rpm