USN-7639-1

It was discovered that the Apache HTTP Server incorrectly handled certain Content-Type response headers. A remote attacker could possibly use this issue to perform HTTP response splitting attacks. (CVE-2024-42516)

xiaojunjie discovered that the Apache HTTP Server mod_proxy module incorrectly handled certain requests. A remote attacker could possibly use this issue to send outbound proxy requests to an arbitrary URL. (CVE-2024-43204)

John Runyon discovered that the Apache HTTP Server mod_ssl module incorrectly escaped certain data. A remote attacker could possibly use this issue to insert escape characters into log files. (CVE-2024-47252)

Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj Somorovsky discovered that the Apache HTTP Server mod_ssl module incorrectly handled TLS 1.3 session resumption. A remote attacker could possibly use this issue to bypass access control. (CVE-2025-23048)

Anthony CORSIEZ discovered that the Apache HTTP Server modproxyhttp2 module incorrectly handled missing host headers. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2025-49630)

Robert Merget discovered that the Apache HTTP Server mod_ssl module incorrectly handled TLS upgrades. A remote attacker could possibly use this issue to hijack an HTTP session. This update removes the old "SSLEngine optional" configuration option, possibly requiring a configuration change in certain environments. (CVE-2025-49812)

Gal Bar Nahum discovered that the Apache HTTP Server incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. (CVE-2025-53020)

References

Affected packages

Ubuntu:22.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2@2.4.52-1ubuntu4.15?arch=source&distro=jammy

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.52-1ubuntu4.15

Affected versions

2.*

2.4.48-3.1ubuntu3

2.4.48-3.1ubuntu4

2.4.51-2ubuntu1

2.4.52-1ubuntu1

2.4.52-1ubuntu2

2.4.52-1ubuntu4

2.4.52-1ubuntu4.1

2.4.52-1ubuntu4.2

2.4.52-1ubuntu4.3

2.4.52-1ubuntu4.4

2.4.52-1ubuntu4.5

2.4.52-1ubuntu4.6

2.4.52-1ubuntu4.7

2.4.52-1ubuntu4.8

2.4.52-1ubuntu4.9

2.4.52-1ubuntu4.10

2.4.52-1ubuntu4.11

2.4.52-1ubuntu4.12

2.4.52-1ubuntu4.13

2.4.52-1ubuntu4.14

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "libapache2-mod-md"
        },
        {
            "binary_version": "2.4.52-1ubuntu4.15",
            "binary_name": "libapache2-mod-proxy-uwsgi"
        }
    ]
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2024-42516",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2024-43204",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2024-47252",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-23048",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-49630",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-49812",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-53020",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:22.04:LTS"
}

Ubuntu:24.04:LTS / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2@2.4.58-1ubuntu8.7?arch=source&distro=noble

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.58-1ubuntu8.7

Affected versions

2.*

2.4.57-2ubuntu2

2.4.57-2ubuntu3

2.4.58-1ubuntu1

2.4.58-1ubuntu2

2.4.58-1ubuntu6

2.4.58-1ubuntu7

2.4.58-1ubuntu8

2.4.58-1ubuntu8.1

2.4.58-1ubuntu8.2

2.4.58-1ubuntu8.3

2.4.58-1ubuntu8.4

2.4.58-1ubuntu8.5

2.4.58-1ubuntu8.6

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "apache2-utils"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "libapache2-mod-md"
        },
        {
            "binary_version": "2.4.58-1ubuntu8.7",
            "binary_name": "libapache2-mod-proxy-uwsgi"
        }
    ]
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2024-42516",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2024-43204",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2024-47252",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-23048",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-49630",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-49812",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-53020",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:24.04:LTS"
}

Ubuntu:25.04 / apache2

Package

Name: apache2
Purl: pkg:deb/ubuntu/apache2@2.4.63-1ubuntu1.1?arch=source&distro=plucky

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.63-1ubuntu1.1

Affected versions

2.*

2.4.62-1ubuntu1

2.4.62-3ubuntu1

2.4.63-1ubuntu1

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_version": "2.4.63-1ubuntu1.1",
            "binary_name": "apache2"
        },
        {
            "binary_version": "2.4.63-1ubuntu1.1",
            "binary_name": "apache2-bin"
        },
        {
            "binary_version": "2.4.63-1ubuntu1.1",
            "binary_name": "apache2-data"
        },
        {
            "binary_version": "2.4.63-1ubuntu1.1",
            "binary_name": "apache2-dev"
        },
        {
            "binary_version": "2.4.63-1ubuntu1.1",
            "binary_name": "apache2-ssl-dev"
        },
        {
            "binary_version": "2.4.63-1ubuntu1.1",
            "binary_name": "apache2-suexec-custom"
        },
        {
            "binary_version": "2.4.63-1ubuntu1.1",
            "binary_name": "apache2-suexec-pristine"
        },
        {
            "binary_version": "2.4.63-1ubuntu1.1",
            "binary_name": "apache2-utils"
        }
    ]
}

Database specific

cves_map

{
    "cves": [
        {
            "id": "CVE-2024-42516",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2024-43204",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2024-47252",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-23048",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-49630",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-49812",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        },
        {
            "id": "CVE-2025-53020",
            "severity": [
                {
                    "type": "CVSS_V3",
                    "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
                },
                {
                    "type": "Ubuntu",
                    "score": "medium"
                }
            ]
        }
    ],
    "ecosystem": "Ubuntu:25.04"
}