Описание
Security update for apache2
This update for apache2 fixes the following issues:
- CVE-2025-55753: Fixed mod_md (ACME), unintended retry intervals (bsc#1254511)
- CVE-2025-58098: Fixed Server Side Includes adds query string to #exec cmd (bsc#1254512)
- CVE-2025-65082: Fixed CGI environment variable override (bsc#1254514)
- CVE-2025-66200: Fixed mod_userdir+suexec bypass via AllowOverride FileInfo (bsc#1254515)
Список пакетов
openSUSE Leap 16.0
Ссылки
- SUSE Security Ratings
- SUSE Bug 1254511
- SUSE Bug 1254512
- SUSE Bug 1254514
- SUSE Bug 1254515
- SUSE CVE CVE-2025-55753 page
- SUSE CVE CVE-2025-58098 page
- SUSE CVE CVE-2025-65082 page
- SUSE CVE CVE-2025-66200 page
Описание
An integer overflow in the case of failed ACME certificate renewal leads, after a number of failures (~30 days in default configurations), to the backoff timer becoming 0. Attempts to renew the certificate then are repeated without delays until it succeeds. This issue affects Apache HTTP Server: from 2.4.30 before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2025-55753
- SUSE Bug 1254511
Описание
Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2025-58098
- SUSE Bug 1254512
Описание
Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache HTTP Server through environment variables set via the Apache configuration unexpectedly superseding variables calculated by the server for CGI programs. This issue affects Apache HTTP Server from 2.4.0 through 2.4.65. Users are recommended to upgrade to version 2.4.66 which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2025-65082
- SUSE Bug 1254514
Описание
mod_userdir+suexec bypass via AllowOverride FileInfo vulnerability in Apache HTTP Server. Users with access to use the RequestHeader directive in htaccess can cause some CGI scripts to run under an unexpected userid. This issue affects Apache HTTP Server: from 2.4.7 through 2.4.65. Users are recommended to upgrade to version 2.4.66, which fixes the issue.
Затронутые продукты
Ссылки
- CVE-2025-66200
- SUSE Bug 1254515