Bug 2374576 (CVE-2025-23048) - CVE-2025-23048 httpd: mod_ssl: access control bypass by trusted clients is possible using TLS 1.3 session resumption
Summary: CVE-2025-23048 httpd: mod_ssl: access control bypass by trusted clients is po...
Keywords:
Status: NEW
Alias: CVE-2025-23048
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2379868
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-06-24 13:28 UTC by OSIDB Bzimport
Modified: 2025-07-14 07:33 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-06-24 13:28:24 UTC 
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.62, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
Note You need to log in before you can comment on or make changes to this bug.