RHSA-2025:14997MediumCVSS 7.5

Red Hat Security Advisory: httpd security update

Published
September 2, 2025
Last Modified
October 21, 2026

🔗 CVE IDs covered (2)

CVE-2024-47252 →CVE-2025-49812 →

📋 Description

CVE-2024-47252 — httpd: insufficient escaping of user-supplied data in mod_ssl CVE-2025-49812 — httpd: HTTP Session Hijack via a TLS upgrade

🎯 Affected products40

  • Red Hat Enterprise Linux Server (v. 7 ELS)
  • Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • httpd-0:2.4.6-99.el7_9.6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-0:2.4.6-99.el7_9.6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-0:2.4.6-99.el7_9.6.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-0:2.4.6-99.el7_9.6.src as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-0:2.4.6-99.el7_9.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-debuginfo-0:2.4.6-99.el7_9.6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-debuginfo-0:2.4.6-99.el7_9.6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • httpd-debuginfo-0:2.4.6-99.el7_9.6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-debuginfo-0:2.4.6-99.el7_9.6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • httpd-debuginfo-0:2.4.6-99.el7_9.6.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-debuginfo-0:2.4.6-99.el7_9.6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • httpd-debuginfo-0:2.4.6-99.el7_9.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-debuginfo-0:2.4.6-99.el7_9.6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • httpd-devel-0:2.4.6-99.el7_9.6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-devel-0:2.4.6-99.el7_9.6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-devel-0:2.4.6-99.el7_9.6.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-devel-0:2.4.6-99.el7_9.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-manual-0:2.4.6-99.el7_9.6.noarch as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-tools-0:2.4.6-99.el7_9.6.ppc64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-tools-0:2.4.6-99.el7_9.6.ppc64le as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-tools-0:2.4.6-99.el7_9.6.s390x as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • httpd-tools-0:2.4.6-99.el7_9.6.x86_64 as a component of Red Hat Enterprise Linux Server (v. 7 ELS)
  • mod_ldap-0:2.4.6-99.el7_9.6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • mod_ldap-0:2.4.6-99.el7_9.6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • mod_ldap-0:2.4.6-99.el7_9.6.s390x as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • mod_ldap-0:2.4.6-99.el7_9.6.x86_64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • mod_proxy_html-1:2.4.6-99.el7_9.6.ppc64 as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • mod_proxy_html-1:2.4.6-99.el7_9.6.ppc64le as a component of Red Hat Enterprise Linux Server Optional (v. 7 ELS)
  • +10 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 Workaround: No mitigation is currently available that meets Red Hat Product Security’s standards for usability, deployment, applicability, or stability.

🔗 References (6)