Homepage

Improper Access Control The advisory has been revoked - it doesn't affect any version of package mod_proxy_html-debuginfo-2.4.37-39.module+el8.4.0+23462+1fa78ba3.10.x86_64.rpm-httpd:2.4/mod_proxy_html-debuginfo  (opens in a new tab)

Threat Intelligence

EPSS
1.04% (63rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL10-MODPROXYHTMLDEBUGINFO243739MODULEEL840234621FA78BA310X8664RPMHTTPD-13505767
  • published9 Oct 2025
  • disclosed14 Jul 2025
Report a new vulnerability Found a mistake?

Introduced: 14 Jul 2025

CVE-2025-23048  (opens in a new tab)
CWE-284  (opens in a new tab)

Amendment

The Red Hat security team deemed this advisory irrelevant for RHEL:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream mod_proxy_html-debuginfo-2.4.37-39.module+el8.4.0+23462+1fa78ba3.10.x86_64.rpm-httpd:2.4/mod_proxy_html-debuginfo package and not the mod_proxy_html-debuginfo-2.4.37-39.module+el8.4.0+23462+1fa78ba3.10.x86_64.rpm-httpd:2.4/mod_proxy_html-debuginfo package as distributed by RHEL.

In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption.

Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.