{"id":"CLSA-2026-1786093474","summary":"Fix of 6 CVEs","details":"   * SECURITY UPDATE: potential SSRF in mod_rewrite via RewriteRule\n     substitutions that produce a scheme-like target\n     - debian/patches/CVE-2024-39573.patch: add the previously stripped\n       per-directory prefix, or an implicit '/' root prefix, to the\n       substituted URI before the query args are split in\n       apply_rewrite_rule() in modules/mappers/mod_rewrite.c; otherwise a\n       rule such as \"RewriteRule ^/some/path(.*) $1\" turns\n       \"/some/pathscheme:...\" into the fully qualified URL \"scheme:...\",\n       which mod_proxy then handles. Upstream fix\n       93aec0e3ca451bcc97f6d91c14d5399d13a73365 (SVN r1918600).\n     - CVE-2024-39573\n   * SECURITY UPDATE: insufficient escaping of mod_ssl variables written to\n     the log by CustomLog\n     - debian/patches/CVE-2024-47252.patch: pass the results of\n       ssl_var_log_handler_c() and ssl_var_log_handler_x() through\n       ap_escape_logitem() in modules/ssl/ssl_engine_vars.c, so an untrusted\n       TLS client can no longer insert escape characters into log files\n       through the %{varname}c and %{varname}x formats logging mod_ssl\n       variables such as SSL_TLS_SNI. Upstream fix\n       c01e60707048be14a510f0a92128a5227923215c (SVN r1927042).\n     - CVE-2024-47252\n   * SECURITY UPDATE: access control bypass by trusted clients through TLS\n     1.3 session resumption in mod_ssl\n     - debian/patches/CVE-2025-23048.patch: move the ssl_server_compatible()\n       check in ssl_hook_ReadReq() in modules/ssl/ssl_engine_kernel.c out of\n       the SNI-present branch, so the handshake virtual host and the request\n       virtual host are compared even when the client sent no SNI, as happens\n       on a resumed TLS 1.3 session; previously such a request could reach a\n       virtual host with different client certificate restrictions when\n       SSLStrictSNIVHostCheck was off. Upstream fix\n       c4cfa50c9068e8b8134c530ab21674e77d1278a2 (SVN r1927043).\n     - CVE-2025-23048\n   * SECURITY UPDATE: denial of service through an assertion failure in\n     mod_proxy_http2\n     - debian/patches/CVE-2025-49630.patch: fall back to the server hostname\n       when ProxyPreserveHost is on but the incoming request carried no Host:\n       header, in open_stream() in modules/http2/h2_proxy_session.c, instead\n       of passing a NULL authority on to the HTTP/2 backend and tripping an\n       assertion. Upstream fix 88304321841a2fe8bd5eacc70e69418b0b545ca5 (SVN\n       r1927044).\n     - CVE-2025-49630\n   * SECURITY UPDATE: query string passed by mod_cgid to Server Side Includes\n     #exec cmd= commands\n     - debian/patches/CVE-2025-58098.patch: pass NULL instead of r-\u003eargs to\n       create_argv() for SSI_REQ requests in cgid_server(), and tolerate a\n       NULL args in create_argv(), in modules/generators/mod_cgid.c;\n       otherwise the shell-escaped query string is appended as arguments to\n       the command line of an SSI \"#exec cmd=...\" directive. Upstream fix\n       ecc1b8f3817e3dcab9c1f24f905752d3c0a279af (SVN r1930161).\n     - CVE-2025-58098\n   * SECURITY UPDATE: integer overflow in the mod_md ACME renewal backoff\n     timer\n     - debian/patches/CVE-2025-55753.patch: double the retry delay step by\n       step with an overflow and cap check in md_job_delay_on_errors() in\n       modules/md/md_status.c instead of shifting job-\u003emin_delay left by\n       err_count-1 in one go; otherwise after roughly 30 days of consecutive\n       renewal failures the shift wraps the signed apr_time_t, the backoff\n       collapses to 0 and the server retries against the ACME CA in a tight\n       loop. Upstream fix 20666cfb765b8ad14efa3d97bc92d344b9395c89 (SVN\n       r1929515).\n     - CVE-2025-55753","modified":"2026-10-26T09:43:40.642364290Z","published":"2026-08-07T09:04:47Z","upstream":["CVE-2024-39573","CVE-2024-47252","CVE-2025-23048","CVE-2025-49630","CVE-2025-55753","CVE-2025-58098"],"references":[{"type":"ADVISORY","url":"https://errata.tuxcare.com/els_os/debian10els/CLSA-2026-1786093474.html"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-39573"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-47252"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-23048"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-49630"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-55753"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-58098"}],"affected":[{"package":{"name":"apache2","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"apache2-bin","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2-bin?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"apache2-data","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2-data?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"apache2-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"apache2-doc","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2-doc?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"apache2-ssl-dev","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2-ssl-dev?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"apache2-suexec-custom","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2-suexec-custom?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"apache2-suexec-pristine","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2-suexec-pristine?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"apache2-utils","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/apache2-utils?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"libapache2-mod-md","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libapache2-mod-md?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}},{"package":{"name":"libapache2-mod-proxy-uwsgi","ecosystem":"TuxCare:Debian:10","purl":"pkg:deb/tuxcare/libapache2-mod-proxy-uwsgi?distro=debian-10"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.59-1~deb10u1+tuxcare.els12"}]}],"database_specific":{"source":"https://github.com/cloudlinux/tuxcare-osv/tree/main/data/els_os/debian10els/CLSA-2026-1786093474.json"}}],"schema_version":"1.9.0"}