USN-7639-2: apache2 Ubuntu

Vulnerability summary

USN-7639-2 is a vulnerability in apache2 Ubuntu with no CVSS score yet.

Timeline

1. 19-08-2025
   PublishedVulnerability first disclosed.
2. 25-06-2026
   Last modifiedVulnerability information updated.

Description

apache2 vulnerabilities USN-7639-1 fixed several vulnerabilities in Apache. This update provides the corresponding update for Ubuntu 16.04 LTS, Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and addressed a regression fix (LP: #2119395). CVE-2025-49630 and CVE-2025-53020 only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. Original advisory details: It was discovered that the Apache HTTP Server incorrectly handled certain Content-Type response headers. A remote attacker could possibly use this issue to perform HTTP response splitting attacks. (CVE-2024-42516) xiaojunjie discovered that the Apache HTTP Server mod_proxy module incorrectly handled certain requests. A remote attacker could possibly use this issue to send outbound proxy requests to an arbitrary URL. (CVE-2024-43204) John Runyon discovered that the Apache HTTP Server mod_ssl module incorrectly escaped certain data. A remote attacker could possibly use this issue to insert escape characters into log files. (CVE-2024-47252) Sven Hebrok, Felix Cramer, Tim Storm, Maximilian Radoy, and Juraj Somorovsky discovered that the Apache HTTP Server mod_ssl module incorrectly handled TLS 1.3 session resumption. A remote attacker could possibly use this issue to bypass access control. (CVE-2025-23048) Anthony CORSIEZ discovered that the Apache HTTP Server mod_proxy_http2 module incorrectly handled missing host headers. A remote attacker could possibly use this issue to cause the server to crash, resulting in a denial of service. (CVE-2025-49630) Robert Merget discovered that the Apache HTTP Server mod_ssl module incorrectly handled TLS upgrades. A remote attacker could possibly use this issue to hijack an HTTP session. This update removes the old "SSLEngine optional" configuration option, possibly requiring a configuration change in certain environments. (CVE-2025-49812) Gal Bar Nahum discovered that the Apache HTTP Server incorrectly handled certain memory operations. A remote attacker could possibly use this issue to cause the server to consume resources, leading to a denial of service. (CVE-2025-53020)

No weakness data has been published for this record.