The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:02683-1 advisory.

    - CVE-2024-42516: Fixed HTTP response splitting. (bsc#1246477)
    - CVE-2024-43204: Fixed a SSRF when mod_proxy is loaded that allows an attacker to send outbound proxy     requests to a URL controlled by them. (bsc#1246305)
    - CVE-2024-47252: Fixed insufficient escaping of user-supplied data in mod_ssl allows an untrusted SSL/TLS     client to insert escape characters into log file. (bsc#1246303)
    - CVE-2025-23048: Fixed access control bypass by trusted clients through TLS 1.3 session resumption in     some mod_ssl configurations. (bsc#1246302)
    - CVE-2025-49630: Fixed denial of service can be triggered by untrusted clients causing an assertion in     mod_proxy_http2. (bsc#1246307)
    - CVE-2025-49812: Fixed Opossum Attack Application Layer Desynchronization using Opportunistic TLS.
    (bsc#1246169)
    - CVE-2025-53020: Fixed HTTP/2 denial of service due to late release of memory after effective lifetime.
    (bsc#1246306)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

SUSE SLES15: apache2 / apache2-devel / apache2-doc / apache2-prefork / etc (SUSE-SU-2025:02683-1)

critical Nessus Plugin ID 243544

Version 1.2