Local Users Could Access Sensitive Application Data Due to Insufficient Permissions in Apache Portable Runtime on Unix Platforms

CVE-2023-49582
5.5MEDIUM

Key Information

Vendor
Apache
Status
Apache Portable Runtime (apr)
Vendor
CVE Published:
26 August 2024

Summary

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Affected Version(s)

Apache Portable Runtime (APR) <= 1.7.4

CVSS V3.1

Score:
5.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published.

  • fixed by r1920083 in 1.7.x. r1920062 is encouraged for functional reasons.

  • Vulnerability Reserved.

  • Reported to security team

  • Discussion on public mailing list https://lists.apache.org/thread/h5f1c2dqm8bf5yfosw3rg85927p612l0

Collectors

NVD DatabaseMitre Database

Credit

Thomas Stangner
.