Threats Tagged 'cve-2025-58098'

Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): * puppet-agent: Out-of-bounds read & write in RFC 3211 KEK Unwrap (CVE-2025-9230) * rubygem-katello: missing repository authorization in content_uploads exposes cross-product content existence (CVE-2026-12515) * puppetserver: HTTP request smuggling via chunked extension quoted-string parsing (CVE-2026-2332) * python-pyjwt: PyJWT: Authentication bypass due to forged JSON Web Tokens (CVE-2026-48526) * python-pillow: Pillow: Denial of Service via crafted PCF font data (CVE-2026-54059) * python-pillow: Pillow: Denial of Service via excessive memory allocation when processing font files (CVE-2026-54060) * rubygem-faraday-cookie_jar: Faraday: Denial of Service via crafted nested query strings (CVE-2026-54297) * python-pillow: Pillow: Denial of Service via crafted BDF font file (CVE-2026-55379) * python-pillow: Pillow: Denial of Service via crafted GD 2.x image file (CVE-2026-55380) * rubygem-nokogiri: Nokogiri: Denial of Service or Information Disclosure via invalid encoding handling (CVE-2026-57236) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * API endpoint GET /api/host_packages/installed_packages in apidoc is wrong (SAT-48096) * Unable to save bookmark report under Hosts > All Hosts > Compliance > Reports (SAT-48150) * Update of scap-security-guide-satellite package sources (SAT-48147) * Switch Satellite 6.17 to OpenVox (SAT-44867) * Katello::Errors::Pulp3Error: nextval: reached maximum value of sequence "container_blobmanifest_id_seq"' during container image sync (SAT-48303)

This security update for Apache HTTP Server (apache2) addresses multiple vulnerabilities including unintended retry intervals in mod_md (ACME), query string injection in Server Side Includes, CGI environment variable override, and a mod_userdir+suexec bypass via AllowOverride FileInfo. The update fixes these issues in affected versions of apache2, improving the security posture of the server. The vulnerabilities have been rated with medium severity and no known exploits are reported in the wild at this time.

This update for apache2 fixes the following issues: - CVE-2025-55753: Fixed mod_md (ACME), unintended retry intervals (bsc#1254511) - CVE-2025-58098: Fixed Server Side Includes adds query string to #exec cmd (bsc#1254512) - CVE-2025-65082: Fixed CGI environment variable override (bsc#1254514) - CVE-2025-66200: Fixed mod_userdir+suexec bypass via AllowOverride FileInfo (bsc#1254515)

This advisory addresses two security vulnerabilities in the Apache HTTP Server (httpd) 2.4 packages provided by Red Hat Enterprise Linux 8.8. The first vulnerability (CVE-2025-55753) involves unintended retry intervals in the mod_md (ACME) module. The second vulnerability (CVE-2025-58098) concerns the Server Side Includes feature adding query strings to the #exec cmd= directive. Red Hat has released an important security update to fix these issues in the httpd:2.4 packages for Red Hat Enterprise Linux 8.8.

Red Hat has issued a security advisory for the Apache HTTP Server (httpd) version 2.4 packages included in Red Hat Enterprise Linux 8.6 variants. The update addresses two vulnerabilities: CVE-2025-55753 involving unintended retry intervals in the mod_md (ACME) module, and CVE-2025-58098 where Server Side Includes improperly add query strings to the #exec cmd directive. These issues have been rated with an Important security impact by Red Hat. The advisory provides updated packages to remediate these vulnerabilities.

Red Hat has issued a security advisory for the Apache HTTP Server (httpd) version 2.4 packages included in Red Hat Enterprise Linux 8.4. The update addresses two vulnerabilities: CVE-2025-55753 affecting the mod_md (ACME) module with unintended retry intervals, and CVE-2025-58098 where Server Side Includes improperly adds query strings to the #exec cmd directive. These issues have been rated with an important security impact by Red Hat Product Security.

Red Hat Hardened Images RPM Release

Red Hat® AI Inference Server

Red Hat® AI Inference Server

Apache HTTP Server 2.4.65 and earlier with Server Side Includes (SSI) enabled and mod_cgid (but not mod_cgi) passes the shell-escaped query string to #exec cmd="..." directives. This issue affects Apache HTTP Server before 2.4.66. Users are recommended to upgrade to version 2.4.66, which fixes the issue.

HighVulnerabilityUnited StatesGermanyUnited Kingdom+7#cve#cve-2025-58098#cwe-201