CVE-2021-35940

December 29, 2021

An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.

Summary:

An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.

Reference Links(if available):

  • http://mail-archives.apache.org/mod_mbox/www-announce/201710.mbox/%3CCACsi251B8UaLvM-rrH9fv57-zWi0zhyF3275_jPg1a9VEVVoxw@mail.gmail.com%3E
  • https://lists.apache.org/thread.html/ra2868b53339a6af65577146ad87016368c138388b09bff9d2860f50e%40%3Cdev.apr.apache.org%3E
  • http://svn.apache.org/viewvc?view=revision&revision=1891198
  • https://dist.apache.org/repos/dist/release/apr/patches/apr-1.7.0-CVE-2021-35940.patch
  • http://www.openwall.com/lists/oss-security/2021/08/23/1

    • CVSS Score (if available)

    v2: / HIGHAV:L/AC:L/Au:N/C:P/I:N/A:P

    v3: / HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

    Links to Exploits(if available)

  • Tags: , , , ,

    You may have missed

    CISA_Logo

    CISA: CISA Releases Insights from Red Team Assessment of a U.S. Critical Infrastructure Sector Organization

    December 20, 2024
    CISA_Logo

    CISA: CISA Adds One Known Exploited Vulnerability to Catalog

    December 20, 2024
    CISA_Logo

    CISA: CISA Releases Six Industrial Control Systems Advisories

    December 20, 2024
    CISA_Logo

    CISA: CISA and Partners Release Joint Guidance on PRC-Affiliated Threat Actor Compromising Networks of Global Telecommunications Providers

    December 20, 2024
    CISA_Logo

    CISA: CISA Adds Three Known Exploited Vulnerabilities to Catalog

    December 20, 2024