Red Hat Product Errata RHSA-2025:15516 - Security Advisory
Issued:
2025-09-08
Updated:
2025-09-08

RHSA-2025:15516 - Security Advisory

Synopsis

Moderate: httpd:2.4 security update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the httpd:2.4 module is now available for Red Hat Enterprise Linux 8.2 Advanced Update Support.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • httpd: insufficient escaping of user-supplied data in mod_ssl (CVE-2024-47252)
  • httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption (CVE-2025-23048)
  • httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module (CVE-2025-49630)
  • httpd: HTTP Session Hijack via a TLS upgrade (CVE-2025-49812)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux Server - AUS 8.2 x86_64

Fixes

  • BZ - 2374571 - CVE-2024-47252 httpd: insufficient escaping of user-supplied data in mod_ssl
  • BZ - 2374576 - CVE-2025-23048 httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption
  • BZ - 2374578 - CVE-2025-49630 httpd: mod_proxy_http2: untrusted input from a client causes an assertion to fail in the Apache mod_proxy_http2 module
  • BZ - 2374580 - CVE-2025-49812 httpd: HTTP Session Hijack via a TLS upgrade

Red Hat Enterprise Linux Server - AUS 8.2

SRPM
httpd-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.src.rpm SHA-256: 46b908130c1b06678917a643ed7895962458d7657109a8691191977a83b305be
mod_http2-1.11.3-3.module+el8.2.0+23461+1d03af5c.5.src.rpm SHA-256: 72d75b3cc4206ecafc3caefccf2f9322cdec289ec516bd97cd77d25c5ba4f858
mod_md-2.0.8-7.module+el8.2.0+5531+7e4d69a2.src.rpm SHA-256: ac0b05f049712493b3fcf948e094b58b87ba5687c6efca902e0fa352ca2c184d
x86_64
httpd-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: cec0ec7dc85032d98fdf988dccac1cddbb5665712fa512b25c635b43742b7370
httpd-debuginfo-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: f3b0f7056dcb94f349ef9876236d0e51b88f858a1b5c27aeb428ccb195966546
httpd-debugsource-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: 919cade263e5415a09b5f4969ce6a9b2f97f64de7c92420181df76c391420930
httpd-devel-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: daac9a1386f453e960108c9137767c64dfaf93609272584b66ddc8a95f6c6d32
httpd-filesystem-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.noarch.rpm SHA-256: 46fe475e5df9f1be65b4f73b72af6536fef6a8975b9bc4787db584bc47c24a04
httpd-manual-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.noarch.rpm SHA-256: 04ef1737c59f40c17c306396c16d7335cdf0ff67bdaa779ae641eaf0d507045c
httpd-tools-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: 3eae7c377fe87df484a4dee7b2bf881cf4752d723a2f30061917fec058069dfc
httpd-tools-debuginfo-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: e331fcf31a6f651af44b82329ffe30de7633f67909b581814c71d00a7b2fd414
mod_http2-1.11.3-3.module+el8.2.0+23461+1d03af5c.5.x86_64.rpm SHA-256: b53407b18527f3257e2b62e1050ca45c9dfb3c8f7fb97a3e4261499cebcc431e
mod_http2-debuginfo-1.11.3-3.module+el8.2.0+23461+1d03af5c.5.x86_64.rpm SHA-256: 320579fa50dd6d13d9d3880a9ca1b94cb0ca0a75d48ed09af04cc27ba0f8b363
mod_http2-debugsource-1.11.3-3.module+el8.2.0+23461+1d03af5c.5.x86_64.rpm SHA-256: 28498e7a918a80dea50cd26973f8f5af2649e0f1a309ea3b386d7bc394f4380a
mod_ldap-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: bce80c32ceeb4675acda0507e396a95b64ade34b89031f21650973420f42ad05
mod_ldap-debuginfo-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: 22e9f33c9b1c3c910a8b7c2840f7eb653d9a6181246270cb0985d68a4e0806b6
mod_md-2.0.8-7.module+el8.2.0+5531+7e4d69a2.x86_64.rpm SHA-256: 488993a0340198b852a125e8857c25595e6bf0f334b47d2a77613ee8a7fb6d37
mod_md-debuginfo-2.0.8-7.module+el8.2.0+5531+7e4d69a2.x86_64.rpm SHA-256: b8773d35478dc2149b1098d646e59184ad4e00e17e37972c860858ee5639c1a1
mod_md-debugsource-2.0.8-7.module+el8.2.0+5531+7e4d69a2.x86_64.rpm SHA-256: 0ff0f0e08de22afce2c2e7cb80ef1ea73925ee27d1c5ff86d45d5669e913826e
mod_proxy_html-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: d6086600299b45eb88927b967f06b4bcb0ff630b8f3bf1c6ca105a0e4ddea857
mod_proxy_html-debuginfo-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: 1e980c7454fd52d3d7646bbdac246db79f55d6eb596968d6333ca003f2f2481f
mod_session-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: 35ce14e7a1e1039aa4d05910e8cf6dc9144d22872f3a28c31d6c8f876816a121
mod_session-debuginfo-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: 3b77fcea6955dc77e4063cbd5a87b9ba04cd86487d23a2d3db60b7a8a535fa53
mod_ssl-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: 71b443a6cadf8a014859acb399e9687e0e7605d26cc9b68fef99c213f52399f1
mod_ssl-debuginfo-2.4.37-21.module+el8.2.0+23461+1d03af5c.10.x86_64.rpm SHA-256: a0d7de6aacf883afc74034fa59ba729bf78b2c6cb081460d07543c293811de45

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.