Medium severity · published Aug 26, 2024
CVE-2023-49582
Apache Portable Runtime (APR): Unexpected lax shared memory permissions
5.5
CVSS
0.3%
EPSS
No
On KEV
Description
Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.
This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)
Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 26% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AP
Apache Portable Runtime (APR) · Apache Software Foundation
0.9.0 through 1.7.4 · source: vendor
PR
Portable Runtime · Apache
0.9.0 before 1.7.5 · source: NVD
Affected product
AP
Apache Portable Runtime (APR)
Apache Software Foundation
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-49582
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-49582
Mailing List
https://lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zdnmv7dc4
www.openwall.com
http://www.openwall.com/lists/oss-security/2024/08/26/1
security.netapp.com
https://security.netapp.com/advisory/ntap-20241101-0004/