CVE-2023-49582

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. 

This issue does not affect non-Unix platforms, or builds withAPR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
apacheCNA
---
---
CISA-ADPADP
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 9%
VendorProductVersion
apacheportable_runtime
0.9.0 ≤
𝑥
< 1.7.5
𝑥
= Vulnerable software versions
Debian logo
Debian Releases
Debian Product
Codename
apr
bullseye (security)
vulnerable
bullseye
ignored
bookworm
1.7.2-3+deb12u1
fixed
sid
1.7.5-1
fixed
trixie
1.7.5-1
fixed
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
apr
oracular
Fixed 1.7.2-3.2ubuntu1
released
noble
Fixed 1.7.2-3.1ubuntu0.1
released
jammy
Fixed 1.7.0-8ubuntu0.22.04.2
released
focal
Fixed 1.6.5-1ubuntu1.1
released
bionic
Fixed 1.6.3-2ubuntu0.1~esm1
released
xenial
Fixed 1.5.2-3ubuntu0.1~esm2
released
trusty
Fixed 1.5.0-1ubuntu0.1~esm2
released
Common Weakness Enumeration
References
https://lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zdnmv7dc4
http://www.openwall.com/lists/oss-security/2024/08/26/1
https://security.netapp.com/advisory/ntap-20241101-0004/