Description
An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Portable Runtime (APR) | Apache Portable Runtime 1.7.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | apr | 1.7.0-7 | — |
| Debian 13 | apr | 1.7.0-7 | — |
| Debian 12 | apr | 1.7.0-7 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | apr | 1.7.0-6ubuntu1 | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 16.04 LTS | apr | 1.5.2-3ubuntu0.1~esm1 | USN-5056-1 |
| Ubuntu Pro 14.04 LTS | apr | 1.5.0-1ubuntu0.1~esm1 | USN-5056-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | apr | 1.7.0-4.1 | openSUSE-SU-2024:11865-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | apr | 1.7.0-r2 | — |
| Alpine v3.23 | apr | 1.7.0-r2 | — |
| Alpine v3.22 | apr | 1.7.0-r2 | — |
| Alpine v3.21 | apr | 1.7.0-r2 | — |
| Alpine v3.20 | apr | 1.7.0-r2 | — |
Show 6 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | apr | 1.7.0-r2 | — |
| Alpine v3.18 | apr | 1.7.0-r2 | — |
| Alpine v3.17 | apr | 1.7.0-r2 | — |
| Alpine v3.16 | apr | 1.7.0-r2 | — |
| Alpine v3.15 | apr | 1.7.0-r1 | — |
| Alpine v3.14 | apr | 1.7.0-r1 | — |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | apr +1 | 1.7.2-2.amzn2023.0.2 | ALAS2023-2023-016 |
| Amazon Linux 2 | apr +1 | 1.7.2-1.amzn2 | ALAS2-2023-1936 |
Advisories 7
- USN-5056-1 apr vulnerability Ubuntu Security Notices (USN) · Jun 29, 2026
- openSUSE-SU-2024:11865-1 apr-devel-1.7.0-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1424 Xerox FreeFlow Print Server für Solaris: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 6, 2025
- ICSA-23-164-03 Rockwell Automation FactoryTalk Edge Gateway CISA ICS & IT advisories · Jun 13, 2023
- ALAS2023-2023-016 Critical: apr security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Feb 22, 2023
- WID-SEC-2023-0064 Apache Portable Runtime (APR): Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Feb 14, 2023
- ALAS2-2023-1936 Critical: apr security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 14, 2023
References
- http://svn.apache.org/viewvc?view=revision&revision=1891198
- http://mail-archives.apache.org/mod_mbox/www-announce/201710.mbox/%3CCACsi251B8UaLvM-rrH9fv57-zWi0zhyF3275_jPg1a9VEVVoxw%40mail.gmail.com%3E
- https://dist.apache.org/repos/dist/release/apr/patches/apr-1.7.0-CVE-2021-35940.patch
- https://lists.apache.org/thread.html/ra2868b53339a6af65577146ad87016368c138388b09bff9d2860f50e%40%3Cdev.apr.apache.org%3E
- [oss-security] 20210823 CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613 mailing-list
- [announce] 20210823 CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613 mailing-list
- [apr-dev] 20210831 APR 1.7.1 release? mailing-list
- [httpd-dev] 20210831 APR 1.7.1 release? mailing-list
- [apr-dev] 20210831 Re: APR 1.7.1 release? mailing-list
- [apr-dev] 20210901 Re: APR 1.7.1 release? mailing-list
- [apr-dev] 20210916 Re: CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613 mailing-list
- [tomcat-dev] 20210922 [jira] [Created] (MTOMCAT-327) Tomcat 9.0.50 and it has apr-1.7.0 dependency, with Address CVE-2021-35940 mailing-list
- [tomcat-dev] 20210922 [jira] [Resolved] (MTOMCAT-327) Tomcat 9.0.50 and it has apr-1.7.0 dependency, with Address CVE-2021-35940 mailing-list
- [tomcat-dev] 20210922 [jira] [Commented] (MTOMCAT-327) Tomcat 9.0.50 and it has apr-1.7.0 dependency, with Address CVE-2021-35940 mailing-list
- [tomcat-dev] 20210922 [jira] [Reopened] (MTOMCAT-327) Tomcat 9.0.50 and it has apr-1.7.0 dependency, with Address CVE-2021-35940 mailing-list
- https://www.oracle.com/security-alerts/cpujul2022.html