Apache Portable Runtime (APR): Schwachstelle ermöglicht Denial of Service

Summary

Product

Vulnerabilities 1

• Unscored —
  CVE-2021-35940

  Regression of CVE-2017-12613

  An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 a…

  Apache Software Foundation Apache Portable Runtime (APR) apr apr Debian Ubuntu Alpine
  Aug 23, 2021

Revision history

1. 2023-02-14 #4

   Neue Updates von Amazon aufgenommen

2. 2023-01-11 #3

   Neue Updates von Juniper aufgenommen

3. 2021-08-30 #2

   Neue Updates von Ubuntu aufgenommen

4. 2021-08-24 #1

   Initiale Fassung

References

• Amazon Linux Security Advisory ALAS2-2023-1936 vom 2023-02-15
  https://alas.aws.amazon.com/AL2/ALAS-2023-1936.html
• Juniper Security Advisory JSA70182 vom 2023-01-12
  https://supportportal.juniper.net/s/article/2023-01-Security-Bulletin-Contrail-Service-Orchestration-Multiple-vulnerabilities-resolved-in-CSO-6-3-0?language=en_US
• Apache Security Advisory vom 2021-08-24
  http://mail-archives.apache.org/mod_mbox/www-announce/201710.mbox/%3CCACsi251B8UaLvM-rrH9fv57-zWi0zhyF3275_jPg1a9VEVVoxw@mail.gmail.com%3E
• Apache Security Advisory vom 2021-08-24
  https://dist.apache.org/repos/dist/release/apr/patches/apr-1.7.0-CVE-2021-35940.patch
• Ubuntu Security Notice USN-5056-1 vom 2021-08-30
  https://ubuntu.com/security/notices/USN-5056-1