PT-2025-29116 · Apache+11 · Apache Http Server+11

John Runyon · Published 2024-09-18 · Updated 2026-05-28 · CVE-2024-47252

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Apache HTTP Server versions prior to 2.4.63

Description: Insufficient escaping of user-supplied data in the mod ssl module can allow an untrusted SSL/TLS client to insert escape characters into log files under certain configurations. This occurs when using CustomLog with "%{varname}x" or "%{varname}c" to log variables provided by mod ssl, such as SSL TLS SNI, without proper sanitization.

Recommendations: Upgrade to a version of Apache HTTP Server later than 2.4.63.

Fix

Weakness Enumeration

CWE-150

Related Identifiers

ALSA-2025:15023

ALSA-2025:15095

ALSA-2025:15123

ALT-PU-2025-9373

ALT-PU-2025-9540

ALT-PU-2025-9924

AZL-65172

AZL-65226

BDU:2025-08958

BIT-APACHE-2024-47252

CESA-2025_15123

CVE-2024-47252

DLA-4270-1

INFSA-2025_15023

INFSA-2025_15123

MGASA-2025-0301

OESA-2025-2168

OESA-2025-2169

OESA-2025-2170

OESA-2025-2171

OESA-2025-2172

OESA-2025-2278

OPENSUSE-SU-2025:15360-1

OPENSUSE-SU-2026:20810-1

RHSA-2025:13680

RHSA-2025:14901

RHSA-2025:14902

RHSA-2025:14903

RHSA-2025:14997

RHSA-2025:15023

RHSA-2025:15095

RHSA-2025:15123

RHSA-2025:15516

RHSA-2025:15619

RHSA-2025:15684

RHSA-2025:15698

RHSA-2025_15023

RHSA-2025_15123

SUSE-SU-2025:02565-1

SUSE-SU-2025:02682-1

SUSE-SU-2025:02683-1

SUSE-SU-2025:02684-1

SUSE-SU-2025:02685-1

SUSE-SU-2025_02565-1

SUSE-SU-2025_02682-1

SUSE-SU-2025_02683-1

SUSE-SU-2025_02684-1

SUSE-SU-2025_02685-1

SUSE-SU-2026:21846-1

USN-7639-1

USN-7639-2

USN-8338-1

Affected Products

Alt Linux

Almalinux

Apache Http Server

Astra Linux

Centos

Debian

Linuxmint

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 143

• https://httpd.apache.org/security/vulnerabilities_24.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-38709 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-49812 · Security Note
• https://osv.dev/vulnerability/ALSA-2025:15123 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2025-0301 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2170 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2168 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-15123.html · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2025-14997.html · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-2278 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/722706 · Security Note
• https://wiki.astralinux.ru/astra-linux-se38-bulletin-2026-0126SE38 · Vendor Advisory
• https://errata.rockylinux.org/RLSA-2025:15123 · Vendor Advisory