Release Date: | 2025-07-10 | |
Impact: | Moderate | What is this? |
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
See more information about CVE-2025-23048 from MITRE CVE dictionary and NIST NVD
NOTE: The following CVSS metrics and score provided are preliminary and subject to review.
Base Score: | 7.5 |
Vector String: | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Version: | 3.1 |
Attack Vector: | Network |
Attack Complexity: | Low |
Privileges Required: | None |
User Interaction: | None |
Scope: | Unchanged |
Confidentiality Impact: | None |
Integrity Impact: | None |
Availability Impact: | High |
Platform | Errata | Release Date |
Oracle Linux version 10 (httpd) | ELSA-2025-15095 | 2025-09-03 |
Oracle Linux version 8 (httpd) | ELSA-2025-15123 | 2025-09-04 |
Oracle Linux version 8 (mod_http2) | ELSA-2025-15123 | 2025-09-04 |
Oracle Linux version 8 (mod_md) | ELSA-2025-15123 | 2025-09-04 |
Oracle Linux version 9 (httpd) | ELSA-2025-15023 | 2025-09-02 |
This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections: