RHSA-2025:15095: Moderate: httpd security update
Moderate: httpd security update
Other sources
The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.Security Fix(es): httpd: insufficient escaping of user-supplied data in modssl (CVE-2024-47252) httpd: modssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048) httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2025:15095?
The severity of RHSA-2025:15095 is classified as Moderate.
How do I fix RHSA-2025:15095?
You can fix RHSA-2025:15095 by updating the httpd package to version 2.4.63-1.el10_0.2 or later.
What vulnerabilities are addressed in RHSA-2025:15095?
RHSA-2025:15095 addresses vulnerabilities including insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252).
Which systems are affected by RHSA-2025:15095?
RHSA-2025:15095 affects various versions of Red Hat Enterprise Linux, including those for IBM z Systems, Power little endian, ARM 64, and x86_64.
What packages are impacted by RHSA-2025:15095?
The affected packages include httpd, httpd-core, httpd-devel, and various debug and debuginfo packages.