{"id":"CLSA-2026-1784045513","summary":"Fix CVE(s): CVE-2024-47252, CVE-2025-49812, CVE-2025-55753, CVE-2025-58098","details":"   * SECURITY UPDATE: query string passed to SSI \"#exec cmd\" via mod_cgid\n     - debian/patches/CVE-2025-58098.patch: in cgid_server() in\n       modules/generators/mod_cgid.c, do not pass the request query string\n       (r-\u003eargs) to create_argv() for Server Side Includes requests by\n       passing NULL when cgid_req.req_type == SSI_REQ, and add a NULL guard\n       to create_argv() so a shell-escaped query string can no longer be\n       split into extra arguments of an SSI \"#exec cmd\" command. Backported\n       from httpd commit ecc1b8f3817e3dcab9c1f24f905752d3c0a279af\n       (SVN r1930161).\n     - CVE-2025-58098\n   * SECURITY UPDATE: log injection via unescaped mod_ssl log variables\n     - debian/patches/CVE-2024-47252.patch: in ssl_var_log_handler_c() and\n       ssl_var_log_handler_x() in modules/ssl/ssl_engine_vars.c, escape the\n       SSL/TLS variables returned by these mod_ssl log handlers with\n       ap_escape_logitem() so client-supplied values such as SSL_TLS_SNI\n       logged via \"%{varname}c\"/\"%{varname}x\" can no longer insert escape\n       characters into log files. Backported from httpd commit\n       c01e60707048be14a510f0a92128a5227923215c (SVN r1927042).\n     - CVE-2024-47252","modified":"2026-10-26T09:32:05.534006494Z","published":"2026-07-14T16:12:14Z","upstream":["CVE-2024-47252","CVE-2025-49812","CVE-2025-55753","CVE-2025-58098"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/ubuntu20.04els/CLSA-2026-1784045513.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47252"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49812"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55753"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58098"}],"affected":[{"package":{"name":"apache2","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"apache2-bin","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2-bin?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"apache2-data","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2-data?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"apache2-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"apache2-doc","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2-doc?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"apache2-ssl-dev","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2-ssl-dev?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"apache2-suexec-custom","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2-suexec-custom?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"apache2-suexec-pristine","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2-suexec-pristine?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"apache2-utils","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/apache2-utils?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"libapache2-mod-md","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libapache2-mod-md?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}},{"package":{"name":"libapache2-mod-proxy-uwsgi","ecosystem":"TuxCare:Ubuntu:20.04","purl":"pkg:deb/tuxcare/libapache2-mod-proxy-uwsgi?distro=ubuntu-20.04"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.41-4ubuntu3.23+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/ubuntu20.04els/CLSA-2026-1784045513.json"}}],"schema_version":"1.9.0"}