Bug#1121926: apache2: CVE-2025-55753 CVE-2025-58098 CVE-2025-65082 CVE-2025-66200

Salvatore Bonaccorso <[email protected]> Thu, 04 Dec 2025 21:12:45 +0100

Newsgroups	gmane.linux.debian.devel.apache
Message-ID	<176487916596.668326.432902117290093049.reportbug__20243.7795860291$1764879269$gmane$org@eldamar.lan>

Source: apache2
Version: 2.4.65-2
Severity: important
Tags: security upstream
X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>

Hi,

The following vulnerabilities were published for apache2.

CVE-2025-55753[0]:
| mod_md (ACME), unintended retry intervals

CVE-2025-58098[1]:
| Server Side Includes adds query string to #exec cmd=...

CVE-2025-65082[2]:
| CGI environment variable override

CVE-2025-66200[3]:
| mod_userdir+suexec bypass via AllowOverride FileInfo

If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-55753
    https://www.cve.org/CVERecord?id=CVE-2025-55753
[1] https://security-tracker.debian.org/tracker/CVE-2025-58098
    https://www.cve.org/CVERecord?id=CVE-2025-58098
[2] https://security-tracker.debian.org/tracker/CVE-2025-65082
    https://www.cve.org/CVERecord?id=CVE-2025-65082
[3] https://security-tracker.debian.org/tracker/CVE-2025-66200
    https://www.cve.org/CVERecord?id=CVE-2025-66200

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore