{"id":"CLSA-2026-1784018824","summary":"Fix CVE(s): CVE-2024-39573, CVE-2025-58098","details":"   * SECURITY UPDATE: potential SSRF via unsafe mod_rewrite substitution\n     - debian/patches/CVE-2024-39573.patch: re-add the stripped per-directory\n       prefix (or an implicit '/') to the substituted URI before it can be\n       mistaken for a scheme:// proxy URL, in modules/mappers/mod_rewrite.c.\n     - CVE-2024-39573\n   * SECURITY UPDATE: SSI #exec cmd query string passed to shell via mod_cgid\n     - debian/patches/CVE-2025-58098.patch: do not pass r-\u003eargs to create_argv()\n       for SSI requests in modules/generators/mod_cgid.c.\n     - CVE-2025-58098","modified":"2026-10-26T09:31:47.204131888Z","published":"2026-07-14T08:47:21Z","upstream":["CVE-2024-39573","CVE-2025-58098"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1784018824.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39573"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58098"}],"affected":[{"package":{"name":"apache2","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018824.json"}},{"package":{"name":"apache2-bin","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-bin?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018824.json"}},{"package":{"name":"apache2-data","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-data?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018824.json"}},{"package":{"name":"apache2-dev","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-dev?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018824.json"}},{"package":{"name":"apache2-doc","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-doc?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018824.json"}},{"package":{"name":"apache2-suexec-custom","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-suexec-custom?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018824.json"}},{"package":{"name":"apache2-suexec-pristine","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-suexec-pristine?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018824.json"}},{"package":{"name":"apache2-utils","ecosystem":"TuxCare:Ubuntu:16.04","purl":"pkg:deb/tuxcare/apache2-utils?distro=ubuntu-16.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:2.4.18-2ubuntu3.17+tuxcare.els23"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu16.04els/CLSA-2026-1784018824.json"}}],"schema_version":"1.9.0"}