Red Hat Product Errata RHSA-2025:23932 - Security Advisory
Issued:
2025-12-22
Updated:
2025-12-22

RHSA-2025:23932 - Security Advisory

Synopsis

Important: httpd security update

Type/Severity

Security Advisory: Important

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for httpd is now available for Red Hat Enterprise Linux 10.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The httpd packages provide the Apache HTTP Server, a powerful, efficient, and extensible web server.

Security Fix(es):

  • httpd: Apache HTTP Server: CGI environment variable override (CVE-2025-65082)
  • httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo (CVE-2025-66200)
  • httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=... (CVE-2025-58098)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 10 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 10 s390x
  • Red Hat Enterprise Linux for Power, little endian 10 ppc64le
  • Red Hat Enterprise Linux for ARM 64 10 aarch64

Fixes

  • BZ - 2419139 - CVE-2025-65082 httpd: Apache HTTP Server: CGI environment variable override
  • BZ - 2419262 - CVE-2025-66200 httpd: Apache HTTP Server: mod_userdir+suexec bypass via AllowOverride FileInfo
  • BZ - 2419365 - CVE-2025-58098 httpd: Apache HTTP Server: Server Side Includes adds query string to #exec cmd=...

Red Hat Enterprise Linux for x86_64 10

SRPM
httpd-2.4.63-4.el10_1.3.src.rpm SHA-256: 039a81d67e40ac87735e1f6a6d49789a42bfc0066f6784761a18426fdbbd542e
x86_64
httpd-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 9b28144e98c29f14b457a4505f35cd3ef0f6e2e0e7ed0cccf4a6541973eaa928
httpd-core-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 8b2e93d6bba45c76f264c08633bb83bfc04e87902539c029f4d17eaa0dc47490
httpd-core-debuginfo-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 24ecc4a1f115d7fe767b1c34d8c9842145c2b1c6182daeb293f99f261fd91729
httpd-debuginfo-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: d07f7ad8f13ed01458ab64778fcbe82ab0b7b78688191a67c853b4670ad83345
httpd-debugsource-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: f2bd0010beb003a7ed144726ddc5a4ca7f9d3a238ead8a23d335c510cdcce18c
httpd-devel-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 5ec84aca6af1542b908322f5c0a1ed70da4a860b9976009d3185f99323ff8af5
httpd-filesystem-2.4.63-4.el10_1.3.noarch.rpm SHA-256: eedff03bc9b84595f27f4051a49a97033d643db2970baa556d789aa69e45a107
httpd-manual-2.4.63-4.el10_1.3.noarch.rpm SHA-256: ca857e288ef3da3da47feab93bd4d32bd28b3f8c99db0d91b2320996cf34eb9b
httpd-tools-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: bae333989df3a6d531cffd83e89c00a9a4c5d71d6b8539d6dc6509b365d6f02a
httpd-tools-debuginfo-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 1662c7f5f0ee39650301bc342378d68dfd9ae6004797c1e5067a26c8ee8ab970
mod_ldap-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 0032d517039060c97b4a4c255a96a863bc33dd12c9613b91dddaf3a2667cedc5
mod_ldap-debuginfo-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 2fef2068aeaddccb845e3700e9e1de13b286c3aafc0bac1fcbdf41f947ba1f82
mod_lua-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 87e5a77fcfb1c6d7b23561b00dec860b16716a4a03ec6cac16376afdf8505d9d
mod_lua-debuginfo-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 50fc56f303545d5846287954e740d1e9626b4a1b47559f7acde000ec468f887d
mod_proxy_html-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: df51d97515c236f02739c51f6ef4d1eca49dfff6e964cd852bf06eaa7746709c
mod_proxy_html-debuginfo-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: d56d30304554a73e51aa543393e67a5a756c2a99cab9aedceb01f2667c62e713
mod_session-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 44e8fab7b0676bc6a94aa6a9b2db6f5939b04ceb7d89d0f152e326ab761b0838
mod_session-debuginfo-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 913a585295d7c4eda30332816fd0d1a54a03f029fdd4a63be4f6172f501d1395
mod_ssl-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 6b3ebea3a4096415bbb8101f0470440cc0436781793f1575340055de0f0f05b4
mod_ssl-debuginfo-2.4.63-4.el10_1.3.x86_64.rpm SHA-256: 0bc0d469bc3d943c6c66077a623b57df14d7bd21e31d4d76ce19730d0dd5b1eb

Red Hat Enterprise Linux for IBM z Systems 10

SRPM
httpd-2.4.63-4.el10_1.3.src.rpm SHA-256: 039a81d67e40ac87735e1f6a6d49789a42bfc0066f6784761a18426fdbbd542e
s390x
httpd-2.4.63-4.el10_1.3.s390x.rpm SHA-256: be413c4ad4d1d47c797c7505980b4bad7c8ee486be6f7f2c1f4196107349ee4c
httpd-core-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 1e3042156ffe338f3ba2550b9928db1da8333ee9b75c90854c569cc453e12b34
httpd-core-debuginfo-2.4.63-4.el10_1.3.s390x.rpm SHA-256: fd0052f357f013547d1459c8b8f22281ee4fa619f0423d2bf6398f9e4f3908ca
httpd-debuginfo-2.4.63-4.el10_1.3.s390x.rpm SHA-256: eb6fc14f18602e78b9e1fb73b60082b2c7af45a61667a5155ebde72f8432c088
httpd-debugsource-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 0c3072f839f9c1f53935739e0c67b04a3c8910d5d1de982b5d7f5ae2bf4131d0
httpd-devel-2.4.63-4.el10_1.3.s390x.rpm SHA-256: dc2914d06cb4b55c487efbea22b05502f07974c003ad00460aae902a289c80dc
httpd-filesystem-2.4.63-4.el10_1.3.noarch.rpm SHA-256: eedff03bc9b84595f27f4051a49a97033d643db2970baa556d789aa69e45a107
httpd-manual-2.4.63-4.el10_1.3.noarch.rpm SHA-256: ca857e288ef3da3da47feab93bd4d32bd28b3f8c99db0d91b2320996cf34eb9b
httpd-tools-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 01e47360454d87b1a2a5273135416c6bb1bae1c7416db733386dd2927ad91af1
httpd-tools-debuginfo-2.4.63-4.el10_1.3.s390x.rpm SHA-256: ae97a956564e4495663d27c721e2124453322863635157fa4e5be665cbb45a65
mod_ldap-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 948263b6759a595f7ee0e584dba8860359c497bb16c4d063b9668021b637cfca
mod_ldap-debuginfo-2.4.63-4.el10_1.3.s390x.rpm SHA-256: d8b656618d5a1737278d3431efb2330b2d8c7690ed91b851697ee72dfa77fa6a
mod_lua-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 2dc1d32a86b8c9487b5c78753b76bbff84dde437e14ef085c0d82d3bc0b14ce0
mod_lua-debuginfo-2.4.63-4.el10_1.3.s390x.rpm SHA-256: d18b10a8489de3a1c1ba827a5773f283fce3ee602fe1953eafa1f225bb93e0a1
mod_proxy_html-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 103adde3f00f702d342a0f8012c064a2632c72a2d69c35f34bec09f31802da58
mod_proxy_html-debuginfo-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 7e0e245fdfd930aa82823838a87efea6b21c31e1664237cb7620e2d9459672fe
mod_session-2.4.63-4.el10_1.3.s390x.rpm SHA-256: b11b864544d4bf9111209c96d64dad7c0921a142e320ceb09828ffee27eabe22
mod_session-debuginfo-2.4.63-4.el10_1.3.s390x.rpm SHA-256: a0c045cdaebe3f4cf513081499fad1d684d7157dcceeb0dd1665a1feda87ea90
mod_ssl-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 7dfe9dd721ef80cd8af3d94e61ee74ca9da532fbf9584c281f2ce44d24c40587
mod_ssl-debuginfo-2.4.63-4.el10_1.3.s390x.rpm SHA-256: 5babc077b064a22f8f4a34a5cc50991ca185fc4be637d595c177bbf02fafca7d

Red Hat Enterprise Linux for Power, little endian 10

SRPM
httpd-2.4.63-4.el10_1.3.src.rpm SHA-256: 039a81d67e40ac87735e1f6a6d49789a42bfc0066f6784761a18426fdbbd542e
ppc64le
httpd-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: b27cc999bcffccd6e1e880226dd6e7133c01175fd50f3f427c8156f6f5dc744d
httpd-core-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 3f1941fd5496864eba355b85e9f00c29997b51082a617eb1431ced4eac32c4f6
httpd-core-debuginfo-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: e626bca174784ccff1153a68a9590bab21ff457fccd3c9a7f9566742878b2bb4
httpd-debuginfo-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 4dc73fd16b329ea125e17b13db98c670482d7d52e872c27cff5d5f77a795fc9c
httpd-debugsource-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 00529c7b4c3f9ecf5aa2ba4736446e0e5c84ed8922b5fbf131001356ccee590d
httpd-devel-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: b5326ac044307977b3409815ccb4b562817aa199dc5d4919bb16f9f66f5c629a
httpd-filesystem-2.4.63-4.el10_1.3.noarch.rpm SHA-256: eedff03bc9b84595f27f4051a49a97033d643db2970baa556d789aa69e45a107
httpd-manual-2.4.63-4.el10_1.3.noarch.rpm SHA-256: ca857e288ef3da3da47feab93bd4d32bd28b3f8c99db0d91b2320996cf34eb9b
httpd-tools-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: b5ab6ff6a6e1fe8445db6e362cd443f9cef54e38b0f667f3766793d6efd09914
httpd-tools-debuginfo-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 4052af6624e1969c3f098aee3527b7fb116111510dbd31469597b1d4e4e2432a
mod_ldap-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 168c5a217963a4281c5b631aadb8bda0b0199bd508c886483e5e7cb1c9ae9275
mod_ldap-debuginfo-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 8b0d2093f9a14226f8baf6dc1fd29d171dc8f560461e29dfbe40c9d0e3108d2f
mod_lua-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 01476374567dfdd558e2c6fb7c77c70f5243f35358ee89bc8cc3da4c486c85cb
mod_lua-debuginfo-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 27e9ab469b4cdad6efefecb769ef36f513f25a97c5580e990f19600822a0a294
mod_proxy_html-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: c81d8b1f33a0da586361326e063ff76735585ba1d5a72f3da7f38efb83ef4e70
mod_proxy_html-debuginfo-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: ae0a30a6a0f52aad3f87a18b07eeb98b0cc49824d556585c737b8a977c51c240
mod_session-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: a31caabd5634fc721a9dbe613259b393a3fe8dd3cc13b95495e55e5849970bea
mod_session-debuginfo-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: a3713357b93aaadff94c803d0de8ad84b081e0ded83362077149a0c0fecf00e3
mod_ssl-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: 3690cc56bf25fb0e427c143a79307f774c477f5cf26ccd143db991dc0358257d
mod_ssl-debuginfo-2.4.63-4.el10_1.3.ppc64le.rpm SHA-256: f1df822fc77f01625fb0bef2d6119c08ab9fcf398bfb66290a3e097c7475373b

Red Hat Enterprise Linux for ARM 64 10

SRPM
httpd-2.4.63-4.el10_1.3.src.rpm SHA-256: 039a81d67e40ac87735e1f6a6d49789a42bfc0066f6784761a18426fdbbd542e
aarch64
httpd-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 52c669c7eddd5fd5e342ea6e63fdb0a98fd0b2652d8537c90938a1ad5aee74ce
httpd-core-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 0199b89d2f81ef48781091095f9270c2f45bbcda407a83bbd57af59abc6f7a05
httpd-core-debuginfo-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 4f3246b858ff7def6b98cb229c64b773e0a73ab6280424c8b1f9c8864e724957
httpd-debuginfo-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 0f97ba56306fd4ebef5db620e4df9575025c624450c1216cd70d392127834605
httpd-debugsource-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: ff1403aaec5f761a968b9b810075b70494021d0fec62d5ff4740e7531c0a2a26
httpd-devel-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 3429ea59809895e616ff84aa01d418a557134befc911155e0a8b061303814341
httpd-filesystem-2.4.63-4.el10_1.3.noarch.rpm SHA-256: eedff03bc9b84595f27f4051a49a97033d643db2970baa556d789aa69e45a107
httpd-manual-2.4.63-4.el10_1.3.noarch.rpm SHA-256: ca857e288ef3da3da47feab93bd4d32bd28b3f8c99db0d91b2320996cf34eb9b
httpd-tools-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 6b8825aa45b17b46a628f89364c8fa9b04407817b763d69597782d568e8ba22b
httpd-tools-debuginfo-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 99cdf1e1d9c9515263bc8f527397006a41a9d234ad0df7ff47dd63ebd1abbe9d
mod_ldap-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 296d954fc6c158b825f6a16bcbd6e25de7724e6ed4a0baf41f9541be07feecdd
mod_ldap-debuginfo-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: b0ed1ff032266ae5e4047be3d306ff2c27822f15f31962a22c1b1c1a272b61ec
mod_lua-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 0539c6cc94acf106e5867489c6946dec4a467ecb53e0cf28102b6b5b6f6205fe
mod_lua-debuginfo-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 969ff6d3c46a233b95ac71aa4448bbcbff02872f86395b426d4045e9964cb76d
mod_proxy_html-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 403a6c50b4d2034aba6133bd4821b5fcf920081a60bb525d741024a894bb5d6e
mod_proxy_html-debuginfo-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: ef48951e15a01119c9d0485447681dcf02b6c71e17f06382718a7204ef341ab9
mod_session-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 06e5aaf6b1e61c2ca19850fccdceecdc5237cf80163f9246af34ef8858a3cab9
mod_session-debuginfo-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 25b2f0503615662f653904b8eadbc84c1a7f38204d88334d99f68244a3b1fa5a
mod_ssl-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 699c5b0309df2c995e970193c0ba1f8259b49a4f842945eb7361e2d7879317cd
mod_ssl-debuginfo-2.4.63-4.el10_1.3.aarch64.rpm SHA-256: 6f74052ff7b13259d45f48fecc5f34ae6aad5525268791c477ab5747c3a275df

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.