|
1 | 1 | -*- coding: utf-8 -*- |
| 2 | +Changes with Apache 2.4.67 |
| 3 | + |
2 | 4 | Changes with Apache 2.4.66 |
3 | 5 |
|
| 6 | + *) SECURITY: CVE-2025-66200: Apache HTTP Server: mod_userdir+suexec |
| 7 | + bypass via AllowOverride FileInfo (cve.mitre.org) |
| 8 | + mod_userdir+suexec bypass via AllowOverride FileInfo |
| 9 | + vulnerability in Apache HTTP Server. Users with access to use |
| 10 | + the RequestHeader directive in htaccess can cause some CGI |
| 11 | + scripts to run under an unexpected userid. |
| 12 | + Credits: Mattias Åsander (Umeå University) |
| 13 | + |
| 14 | + *) SECURITY: CVE-2025-65082: Apache HTTP Server: CGI environment |
| 15 | + variable override (cve.mitre.org) |
| 16 | + Improper Neutralization of Escape, Meta, or Control Sequences |
| 17 | + vulnerability in Apache HTTP Server through environment |
| 18 | + variables set via the Apache configuration unexpectedly |
| 19 | + superseding variables calculated by the server for CGI programs. |
| 20 | + Credits: Mattias Åsander (Umeå University) |
| 21 | + |
| 22 | + *) SECURITY: CVE-2025-59775: Apache HTTP Server: NTLM Leakage on |
| 23 | + Windows through UNC SSRF (cve.mitre.org) |
| 24 | + Server-Side Request Forgery (SSRF) vulnerability |
| 25 | + in Apache HTTP Server on Windows with AllowEncodedSlashes On and |
| 26 | + MergeSlashes Off allows to potentially leak NTLM hashes to a malicious |
| 27 | + server via SSRF and malicious requests or content |
| 28 | + Credits: Orange Tsai (@orange_8361) from DEVCORE |
| 29 | + |
| 30 | + *) SECURITY: CVE-2025-58098: Apache HTTP Server: Server Side |
| 31 | + Includes adds query string to #exec cmd=... (cve.mitre.org) |
| 32 | + Apache HTTP Server 2.4.65 and earlier with Server Side Includes |
| 33 | + (SSI) enabled and mod_cgid (but not mod_cgi) passes the |
| 34 | + shell-escaped query string to #exec cmd="..." directives. |
| 35 | + Credits: Anthony Parfenov (United Rentals, Inc.) |
| 36 | + |
| 37 | + *) SECURITY: CVE-2025-55753: Apache HTTP Server: mod_md (ACME), |
| 38 | + unintended retry intervals (cve.mitre.org) |
| 39 | + An integer overflow in the case of failed ACME certificate |
| 40 | + renewal leads, after a number of failures (~30 days in default |
| 41 | + configurations), to the backoff timer becoming 0. Attempts to |
| 42 | + renew the certificate then are repeated without delays until it |
| 43 | + succeeds. |
| 44 | + Credits: Aisle Research |
| 45 | + |
4 | 46 | *) mod_http2: Fix handling of 304 responses from mod_cache. PR 69580. |
5 | 47 | [Stefan Eissing] |
6 | 48 |
|
|
0 commit comments