* SECURITY UPDATE: query string passed to SSI "#exec cmd" via mod_cgid - debian/patches/CVE-2025-58098.patch: in cgid_server() in modules/generators/mod_cgid.c, do not pass the request query string (r->args) to create_argv() for Server Side Includes requests by passing NULL when cgid_req.req_type == SSI_REQ, and add a NULL guard to create_argv() so a shell-escaped query string can no longer be split into extra arguments of an SSI "#exec cmd" command. Backported from httpd commit ecc1b8f3817e3dcab9c1f24f905752d3c0a279af (SVN r1930161). - CVE-2025-58098 * SECURITY UPDATE: log injection via unescaped mod_ssl log variables - debian/patches/CVE-2024-47252.patch: in ssl_var_log_handler_c() and ssl_var_log_handler_x() in modules/ssl/ssl_engine_vars.c, escape the SSL/TLS variables returned by these mod_ssl log handlers with ap_escape_logitem() so client-supplied values such as SSL_TLS_SNI logged via "%{varname}c"/"%{varname}x" can no longer insert escape characters into log files. Backported from httpd commit c01e60707048be14a510f0a92128a5227923215c (SVN r1927042). - CVE-2024-47252