CLSA-2026-1784045513
See a problem?- Import Source
- https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json
- JSON Data
- https://api.osv.dev/v1/vulns/CLSA-2026-1784045513
- Upstream
- Published
- 2026-07-14T16:12:14Z
- Modified
- 2026-10-26T09:32:05Z
- Summary
- Fix CVE(s): CVE-2024-47252, CVE-2025-49812, CVE-2025-55753, CVE-2025-58098
- Details
-
- SECURITY UPDATE: query string passed to SSI "#exec cmd" via mod_cgid
- debian/patches/CVE-2025-58098.patch: in cgid_server() in modules/generators/mod_cgid.c, do not pass the request query string (r->args) to create_argv() for Server Side Includes requests by passing NULL when cgid_req.req_type == SSI_REQ, and add a NULL guard to create_argv() so a shell-escaped query string can no longer be split into extra arguments of an SSI "#exec cmd" command. Backported from httpd commit ecc1b8f3817e3dcab9c1f24f905752d3c0a279af (SVN r1930161).
- CVE-2025-58098
- SECURITY UPDATE: log injection via unescaped mod_ssl log variables
- debian/patches/CVE-2024-47252.patch: in ssl_var_log_handler_c() and ssl_var_log_handler_x() in modules/ssl/ssl_engine_vars.c, escape the SSL/TLS variables returned by these mod_ssl log handlers with ap_escape_logitem() so client-supplied values such as SSL_TLS_SNI logged via "%{varname}c"/"%{varname}x" can no longer insert escape characters into log files. Backported from httpd commit c01e60707048be14a510f0a92128a5227923215c (SVN r1927042).
- CVE-2024-47252
- SECURITY UPDATE: query string passed to SSI "#exec cmd" via mod_cgid
- References