Local Users Could Access Sensitive Application Data Due to Insufficient Permissions in Apache Portable Runtime on Unix Platforms

CVE-2023-49582

5.5MEDIUM

Key Information

Vendor
Apache
Status
Apache Portable Runtime (apr)
Vendor
CVE Published:
26 August 2024

Summary

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.

This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)

Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Affected Version(s)

Apache Portable Runtime (APR) <= 1.7.4

References

https://lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zd...
vendor-advisory

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database

Credit

Thomas Stangner
.