Red Hat Product Errata RHSA-2025:23919 - Security Advisory
Issued:
2025-12-22
Updated:
2025-12-22

RHSA-2025:23919 - Security Advisory

Synopsis

Important: httpd security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for httpd is now available for Red Hat Enterprise Linux 9.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  • httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)
  • httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 9 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 9 s390x
  • Red Hat Enterprise Linux for Power, little endian 9 ppc64le
  • Red Hat Enterprise Linux for ARM 64 9 aarch64

Fixes

  • BZ - 2419139 - CVE-2025-65082 httpd: Apache HTTP Server: CGI environment variable override
  • BZ - 2419262 - CVE-2025-66200 httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo
  • BZ - 2419365 - CVE-2025-58098 httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

Red Hat Enterprise Linux for x86_64 9

SRPM
httpd-2.4.62-7.el9_7.3.src.rpm SHA-256: 42b931cb6bbb6aae4fbdff5942eac5ccc47f4e2c9fcbadb26606db0d690d8f86
x86_64
httpd-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: b859e83f1627761e27ab845514c962b52f47eecb116782e200590fce456f32b1
httpd-core-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 8883f7cd232ec762dd4d0e7cbdf39eb2306c46233662d547f3232d2ae2d97597
httpd-core-debuginfo-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 3eb1e7ca791b0f7c22ab28fadfcfd39f5f9142f357e9cbdc905c569c81392f48
httpd-debuginfo-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 9ad2454d752415f5086d4d05c6f50144af755f56f4c7869c6630aad13df73420
httpd-debugsource-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 9c6ae887d6f725917ee659e756b8ae9ce356cd49566484f6a9f14bf20c796394
httpd-devel-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 662d65d2c23ba852c8bd1790b24a8f7ad76c590e7446bfaaf22dcfca4bc693d8
httpd-filesystem-2.4.62-7.el9_7.3.noarch.rpm SHA-256: 4c9296d2eed626c4e42c035fed06a38224411fc8804becc4aee18b026683a9d3
httpd-manual-2.4.62-7.el9_7.3.noarch.rpm SHA-256: 090f8092fb08db71e9071ce335513b1122a4c17ac8fd0e4ad88cc1ea3d4f44e0
httpd-tools-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 625f056d612a31b943bc7e8518a4b28087cda034558c60312be5324992607380
httpd-tools-debuginfo-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: c06f8a184ebae2b8cdcdbcdcfda04ebbbed244ec1df3aafa8bb5029507201e65
mod_ldap-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 63839df4588340baa492a7f6750bc4b356cf6e9c664bd661486ac2b7a83e7048
mod_ldap-debuginfo-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 79f6c3bb4c9dd4d2d5bc390b01a9dcefcdf5294d540c37984d3e872cdfd04fc5
mod_lua-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 173916d480086e408d1d031eb5fd3533dcd5bb37976a06a0770270487253c5ec
mod_lua-debuginfo-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: f201d0dca1757134f64374ed9dff4aad61b921b8fd059616c1a9ca7fee862c00
mod_proxy_html-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 355bb38c26b669270b5b057d793f2f3e02c6a1f1289c67ff010977fc5ad9bb2c
mod_proxy_html-debuginfo-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 74bd7dbe4eb269d8adf3e84faa356ea969b5dc6427cc4d5329d74c56b1c4f636
mod_session-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: e2d56ecbd8685ef94aca7f465857a5e81fd1c9085b31de0a1190f66ce402ff4c
mod_session-debuginfo-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 7db880506f7ffceb1628dc03b8e267ea6c4513e357d19b16e9b202832268f9b1
mod_ssl-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: 546b143dcc47a1d4ab32ec57260c76ad8227049b1d3bd96eba46767f25297d6d
mod_ssl-debuginfo-2.4.62-7.el9_7.3.x86_64.rpm SHA-256: fff6c0fcab0ef26ca927537bf5d6d552d40ca104bc79c0e7a2187a22bd138bba

Red Hat Enterprise Linux for IBM z Systems 9

SRPM
httpd-2.4.62-7.el9_7.3.src.rpm SHA-256: 42b931cb6bbb6aae4fbdff5942eac5ccc47f4e2c9fcbadb26606db0d690d8f86
s390x
httpd-2.4.62-7.el9_7.3.s390x.rpm SHA-256: d46aa362129133e1f0387e69a0a8f1edfa72154a045d286edf45094aac4796ba
httpd-core-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 42878801d8f28d3b65e3a2d052abef8d38f912d15aa23293c5a4a7f3a3ff9a08
httpd-core-debuginfo-2.4.62-7.el9_7.3.s390x.rpm SHA-256: fdf2bb61869e22cdb00b10cd3c953dde08bfe920cd4c8213f589db8ecc18ecfd
httpd-debuginfo-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 07b1d07dbd0937a52b4d6175dce2682a786792352ad358e99cd0908961e560fb
httpd-debugsource-2.4.62-7.el9_7.3.s390x.rpm SHA-256: b6fb846f9a75057135d54601b728b2c30975d27bf58cb1380ff29d65f77e8edc
httpd-devel-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 690008e22fad912f05415c72b4ed63985c27871c18a5bef372cc6919a3452d63
httpd-filesystem-2.4.62-7.el9_7.3.noarch.rpm SHA-256: 4c9296d2eed626c4e42c035fed06a38224411fc8804becc4aee18b026683a9d3
httpd-manual-2.4.62-7.el9_7.3.noarch.rpm SHA-256: 090f8092fb08db71e9071ce335513b1122a4c17ac8fd0e4ad88cc1ea3d4f44e0
httpd-tools-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 3fdcf39275f477a028e36114be001011972ddf63856c2cea9c08c95d484bc381
httpd-tools-debuginfo-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 0139a5561febfb6c4115924f467f607b5529ebba2eb5fe6b9ef185c382261d72
mod_ldap-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 6472b43eedab8aac2723ba0ccb0d8bf402977446460d78cbe4ba8c384e8263e7
mod_ldap-debuginfo-2.4.62-7.el9_7.3.s390x.rpm SHA-256: a4b4a1cc6af2b0f48edcaad0dbf99eba9472633d111c33a1e04e91072f9ade95
mod_lua-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 4186345d3892340394aee158bf8c90d3b73cd506274bcb27cd007889a04fd858
mod_lua-debuginfo-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 1168c31137540eb2ca8e4af7cf4eae1a22acd81293ecb9399a7e63bf4f13e370
mod_proxy_html-2.4.62-7.el9_7.3.s390x.rpm SHA-256: f5feff472101d0410a1cf7775e33bbab7debe5846d7254cefc549b01dd007b52
mod_proxy_html-debuginfo-2.4.62-7.el9_7.3.s390x.rpm SHA-256: c7e1ebcd2c3449d0a0c66ce5c5eda442eb3f937484a83d58484408cbc73f2ddf
mod_session-2.4.62-7.el9_7.3.s390x.rpm SHA-256: cde7ad6b32c7367d6db83ccf3c8e9c251c7096473d71f04c15ee0e00a8e81830
mod_session-debuginfo-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 3ded0c6637721e2e1cb7b550ce0b0b7ed662486985317948bd80eb56993cac7a
mod_ssl-2.4.62-7.el9_7.3.s390x.rpm SHA-256: c553423ee23c1d8d9a305daf73ad71c8dfc46e68a49c8c01fa3a71af574694d3
mod_ssl-debuginfo-2.4.62-7.el9_7.3.s390x.rpm SHA-256: 8482efff2054945ac09a16b15bd175cc6a1fbc98d69ecacb71718efac47f1d55

Red Hat Enterprise Linux for Power, little endian 9

SRPM
httpd-2.4.62-7.el9_7.3.src.rpm SHA-256: 42b931cb6bbb6aae4fbdff5942eac5ccc47f4e2c9fcbadb26606db0d690d8f86
ppc64le
httpd-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 04ca86c16e10ec465df8d1f0d4c6494c602423c4ec77139f369d27a99386d7e4
httpd-core-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: ae3be5bb576a2200b0de5f68103a2c94f92473a7e1dc440ac2f5d618ce3c0928
httpd-core-debuginfo-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: cf8e29c9ac81e8de8cd0322adaedaf9b790ff115bb535e2007b37a8f4a8dbc6a
httpd-debuginfo-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 8eb028f503f9d88e87f0429358aa54a15bd68e15ce675207de84ce1a68e51035
httpd-debugsource-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: b08f69e6137a62f8fc8602aaa04ba9ab19f14c48969e33aa82489f4330017713
httpd-devel-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: fb25aa81d0ac2c68f055a98cc392b5ec754d2729089966f7a524ac818c9e07a9
httpd-filesystem-2.4.62-7.el9_7.3.noarch.rpm SHA-256: 4c9296d2eed626c4e42c035fed06a38224411fc8804becc4aee18b026683a9d3
httpd-manual-2.4.62-7.el9_7.3.noarch.rpm SHA-256: 090f8092fb08db71e9071ce335513b1122a4c17ac8fd0e4ad88cc1ea3d4f44e0
httpd-tools-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: b5c3387ded33cd8468a9884c810f482c830a0a1579874a703b936f52d2106672
httpd-tools-debuginfo-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: bbef76f72dd169d66cab663f67f4575e6f17bfea805066a41d2bc9ca53f932a9
mod_ldap-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 1a4cae0bbe59a066240070dec919a06bc6a4c13643f975bb6bc3cc4ff6cbc00d
mod_ldap-debuginfo-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 7ccc3fd660edddaf55f5ef410ccbe247df0dfdd5000bf6b1ad1cb234d41cee70
mod_lua-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: da194b5216402e576ea1a4abe8d960d6455b73a41b7e9a73d8d97b4ee4c65ca7
mod_lua-debuginfo-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: ea2ddfbbadc669079d9f68a69da885fb859d332d10cd7e74e33204b64613f3d8
mod_proxy_html-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 3b00cbaecd999c3cc0203be64d14a2f694b130de1d9b250f1ffde3836d7520e8
mod_proxy_html-debuginfo-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 2777188c9c435893bfa691ebee592828e7abfc51f0705620e445c6c43d92583d
mod_session-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 2f06d4a722b1cd120fee15312b7a14731ee9eeaaa83212c5645de5c707768100
mod_session-debuginfo-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: cd891294661b8f4447a5b5328c560bab96b93152b9003e85386d749edf09da52
mod_ssl-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 6f7cd1c9deedc4ee4abfa11a01d10617a7509c73716addfd87f1aba48127d994
mod_ssl-debuginfo-2.4.62-7.el9_7.3.ppc64le.rpm SHA-256: 4553a4c2497baede38454d4c9d32aecc49cf9cf1389348174ae57cfe95bd1fef

Red Hat Enterprise Linux for ARM 64 9

SRPM
httpd-2.4.62-7.el9_7.3.src.rpm SHA-256: 42b931cb6bbb6aae4fbdff5942eac5ccc47f4e2c9fcbadb26606db0d690d8f86
aarch64
httpd-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 97435c0aaa2c8c080e22b374ad2e26a6e72e8ff3ee03915961093aaa3f78dcda
httpd-core-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 810b4db187d383576174668c74661e50fc20975512f907af0c87279c0b85f8ae
httpd-core-debuginfo-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 14f6d533046d1e5074fae7d9a1e568e76ecbb10b444aff9727c9ae7039dc502b
httpd-debuginfo-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: ed88ae57215a646e82d71d310de7cf7328352f6c682a78d15dd8903111e01ab6
httpd-debugsource-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: a925e20df0bcf92a147e3dfdd728bfe39eff3ecc4b2c4df3f9747b1e0387d241
httpd-devel-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: e20f925baf399d0c9e076962b5eb77965701bfb5fe078430c3eb6180a5981900
httpd-filesystem-2.4.62-7.el9_7.3.noarch.rpm SHA-256: 4c9296d2eed626c4e42c035fed06a38224411fc8804becc4aee18b026683a9d3
httpd-manual-2.4.62-7.el9_7.3.noarch.rpm SHA-256: 090f8092fb08db71e9071ce335513b1122a4c17ac8fd0e4ad88cc1ea3d4f44e0
httpd-tools-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 48a0ea735a41c3b42ca41220b91d35ef30aaf4090bebab8fdde7aff77f07e590
httpd-tools-debuginfo-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 05deec4f1bb2fa02022742ffc48aec3f3b7057dd11ebca8e308927f409dd6ff8
mod_ldap-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 5cea1fd5839a3a48c40ee0b12db2cf864d328bf2a229affa575a757af1933c98
mod_ldap-debuginfo-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: a57a73c7afb4510b4d81c826e7bb6ba2a5b900e3ee7c4006351eacc22f20320c
mod_lua-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 94038d3475441740691c086a1db3f1dc7bc2714f7e7f0824c7068f0a4a26acfc
mod_lua-debuginfo-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: a92f5232ad6e052f89b3630399590e3ecf3f4f19edc30c5b16baa9b7cf880412
mod_proxy_html-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: a46f5b936c90ff83240e03f34142561581c4fe24938c1834eaf8ff8c54f27086
mod_proxy_html-debuginfo-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 7df266b060b72b2ae078316a9bee417c3094d00e735005b455cbfe50b6d1389e
mod_session-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 42c946b0d6ab47b2443f72d88c89d3067d03e2ef4813e37c763fa9650f677e51
mod_session-debuginfo-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 9f3de6c12fc54e0304f24696c5158368054954ce7e5cacc40df30f62ec0e6aca
mod_ssl-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 97f141bfb8cf31b53ec66aefcca224bea0432c67ffade75606aeea7b38bab457
mod_ssl-debuginfo-2.4.62-7.el9_7.3.aarch64.rpm SHA-256: 5ebc2030788c09e8606581bbf37d3664c832065ca271d9d0669c7bb28bdf5996

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.