CVE-2022-24963

Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer.
This issue affects Apache Portable Runtime (APR) version 1.7.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
9.8 CRITICAL
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 70%
Affected Products (NVD)
VendorProductVersion
apacheportable_runtime
1.7.0
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
apr
bookworm
1.7.2-3
fixed
bullseye
1.7.0-6+deb11u2
fixed
bullseye (security)
1.7.0-6+deb11u2
fixed
buster
not-affected
sid
1.7.5-1
fixed
trixie
1.7.5-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apr
bionic
not-affected
focal
not-affected
jammy
Fixed 1.7.0-8ubuntu0.22.04.1
released
kinetic
Fixed 1.7.0-8ubuntu0.22.10.1
released
trusty
not-affected
xenial
not-affected
Red Hat logo
Red Hat Enterprise Linux Releases
Red Hat Product
Release
apr
RHEL 9
0:1.7.0-12.el9_3
fixed
apr-devel
RHEL 9
0:1.7.0-12.el9_3
fixed
Amazon Linux logo
Amazon Linux Releases
Amazon Package
Release
apr
Amazon Linux 2
0:1.7.2-1.amzn2
fixed
Amazon Linux 2023
0:1.7.2-2.amzn2023.0.2
fixed
apr-debuginfo
Amazon Linux 2
0:1.7.2-1.amzn2
fixed
Amazon Linux 2023
0:1.7.2-2.amzn2023.0.2
fixed
apr-debugsource
Amazon Linux 2023
0:1.7.2-2.amzn2023.0.2
fixed
apr-devel
Amazon Linux 2
0:1.7.2-1.amzn2
fixed
Amazon Linux 2023
0:1.7.2-2.amzn2023.0.2
fixed
Azure Linux logo
Azure Linux Releases
Azure Package
Release
apr
Azure Linux 3.0
0:1.7.2-1.azl3
fixed
CBL-Mariner 2.0
0:1.7.2-1.cm2
fixed
Common Weakness Enumeration
References
https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
https://security.netapp.com/advisory/ntap-20230908-0008/
https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
https://security.netapp.com/advisory/ntap-20230908-0008/