EUVD-2025-21018CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Lifecycle Timeline
4Description
In some mod_ssl configurations on Apache HTTP Server 2.4.35 through to 2.4.63, an access control bypass by trusted clients is possible using TLS 1.3 session resumption. Configurations are affected when mod_ssl is configured for multiple virtual hosts, with each restricted to a different set of trusted client certificates (for example with a different SSLCACertificateFile/Path setting). In such a case, a client trusted to access one virtual host may be able to access another virtual host, if SSLStrictSNIVHostCheck is not enabled in either virtual host.
Analysis
CVE-2025-23048 is an authentication bypass vulnerability in Apache HTTP Server 2.4.35-2.4.63 affecting mod_ssl configurations with multiple virtual hosts using different client certificate restrictions. An attacker with valid client certificates trusted by one virtual host can exploit TLS 1.3 session resumption to access another restricted virtual host if SSLStrictSNIVHostCheck is not enabled, achieving unauthorized access to confidential information and potentially modifying data. This is a network-accessible vulnerability with no authentication required and high real-world impact.
Technical Context
The vulnerability stems from improper session resumption handling in TLS 1.3 within mod_ssl (CWE-284: Improper Access Control). TLS 1.3 introduced stateless session resumption using Pre-Shared Keys (PSK), which allows clients to resume sessions without full re-authentication. In multi-virtual-host Apache configurations where each vhost enforces different SSLCACertificateFile/Path settings for client certificate validation, the session state may not be properly bound to the originating virtual host's certificate requirements. When SSLStrictSNIVHostCheck is disabled, SNI validation is insufficient to prevent cross-vhost session reuse. Affected CPE: cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* (versions 2.4.35 through 2.4.63). The root cause is inadequate enforcement of access control policies across session lifecycle in a multi-tenant virtual host context (CWE-284).
Affected Products
Apache HTTP Server (2.4.35 through 2.4.63)
Remediation
- action: Upgrade Apache HTTP Server; details: Patch to version 2.4.64 or later, which includes the fix for TLS 1.3 session resumption validation across virtual hosts - action: Enable SSLStrictSNIVHostCheck; details: Set 'SSLStrictSNIVHostCheck on' in all virtual host configurations that enforce per-vhost client certificate policies. This enforces strict SNI-to-vhost matching and prevents session reuse across vhosts; applicable_versions: All 2.4.35-2.4.63 (temporary mitigation pending upgrade) - action: Disable TLS 1.3 session resumption; details: Configure 'SSLSessionTickets off' and 'SSLSessionCache none' per virtual host to disable session resumption entirely, eliminating the attack vector (performance impact acceptable for high-security deployments); applicable_versions: Temporary workaround for 2.4.35-2.4.63 - action: Implement additional vhost isolation; details: Use separate listening addresses (IP:port combinations) per virtual host instead of SNI-based sharing to enforce network-level isolation independent of TLS session handling
Priority Score
Vendor Status
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| upstream | released | 2.4.64-1 |
| jammy | released | 2.4.52-1ubuntu4.15 |
| noble | released | 2.4.58-1ubuntu8.7 |
| plucky | released | 2.4.63-1ubuntu1.1 |
| bionic | released | 2.4.29-1ubuntu4.27+esm6 |
| focal | released | 2.4.41-4ubuntu3.23+esm2 |
| xenial | released | 2.4.18-2ubuntu3.17+esm16 |
| questing | released | 2.4.64-1ubuntu1 |
Debian
| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | fixed | 2.4.65-1~deb11u1 | - |
| bullseye (security) | fixed | 2.4.66-1~deb11u1 | - |
| bookworm | fixed | 2.4.65-1~deb12u1 | - |
| bookworm (security) | vulnerable | 2.4.62-1~deb12u2 | - |
| trixie | fixed | 2.4.66-1~deb13u2 | - |
| forky, sid | fixed | 2.4.66-8 | - |
| (unstable) | fixed | 2.4.64-1 | - |
Share
External POC / Exploit Code
Leaving vuln.today