Wind River Support Network

HomeDefectsLIN1021-16805

Acknowledged

LIN1021-16805 : Security Advisory - apache2 - CVE-2025-49812

Created: Jul 11, 2025 Updated: Aug 11, 2025

Found In Version: 10.21.20.1

Severity: Standard

Applicable for: Wind River Linux LTS 21

Component/s: Userspace

Description

In some mod_ssl configurations on Apache HTTP Server versions through to 2.4.63, an HTTP desynchronisation attack allows a man-in-the-middle attacker to hijack an HTTP session via a TLS upgrade.EOL][EOL]Only configurations using "SSLEngine optional" to enable TLS upgrades are affected. Users are recommended to upgrade to version 2.4.64, which removes support for TLS upgrade.

CREATE(Triage):(User=admin) [CVE-2025-49812 (https://nvd.nist.gov/vuln/detail/CVE-2025-49812)