svn commit: r1936930 - apr/site/trunk/security-json
[email protected] Thu, 06 Aug 2026 14:37:04 -0000
Newsgroups
gmane.comp.apache.apr.cvs
Message-ID
<178602702438.3079121.2079392589629851011@svn03-he-fi>
Author: jorton
Date: Thu Aug 6 14:37:04 2026
New Revision: 1936930
Log:
Add JSON input files for generating the vulnerability list (in next commit).
Added:
apr/site/trunk/security-json/
apr/site/trunk/security-json/CVE-2025-49506.json (contents, props changed)
apr/site/trunk/security-json/CVE-2026-32327.json (contents, props changed)
apr/site/trunk/security-json/CVE-2026-34191.json (contents, props changed)
apr/site/trunk/security-json/CVE-2026-34501.json (contents, props changed)
apr/site/trunk/security-json/CVE-2026-34502.json (contents, props changed)
Added: apr/site/trunk/security-json/CVE-2025-49506.json
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ apr/site/trunk/security-json/CVE-2025-49506.json Thu Aug 6 14:37:04 2026 (r1936930)
@@ -0,0 +1,107 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageName": "APR-util",
+ "product": "Apache Portable Runtime Utility",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.6.3",
+ "status": "affected",
+ "version": "1.2.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Michael Rowley <michael csirt.global>"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<div>APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as <span style=\"background-color: rgb(255, 255, 255);\"> Windows, BeOS, NetWare, or Android.</span></div><div>Users are recommended to upgrade to version 1.6.4, which fixes this issue.<br></div><div></div>"
+ }
+ ],
+ "value": "APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "low"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-208",
+ "description": "CWE-208 Observable Timing Discrepancy",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/2v8o3bj9pb7lfcr57bdnjg9xfkj04mg5"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2024-06-03T00:00:00.000Z",
+ "value": "Reported to security team"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:00:00.000Z",
+ "value": "fixed in 1.6.x by r1936805"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:58:00.000Z",
+ "value": "1.6.4 released"
+ }
+ ],
+ "title": "Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2025-49506",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
Added: apr/site/trunk/security-json/CVE-2026-32327.json
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ apr/site/trunk/security-json/CVE-2026-32327.json Thu Aug 6 14:37:04 2026 (r1936930)
@@ -0,0 +1,112 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "packageName": "APR-util",
+ "product": "Apache Portable Runtime Utility",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.6.3",
+ "status": "affected",
+ "version": "0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Younghyo Cho @ CISLab, SeoulTech"
+ },
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "4ra1n, pyn3rd and unam4"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.<br><br>Users are recommended to upgrade to version 1.6.4, which fixes this issue."
+ }
+ ],
+ "value": "A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes this issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-674",
+ "description": "CWE-674 Uncontrolled Recursion",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/hq27vj8yfno9tkwv0fpj6jksfzgxvth1"
+ }
+ ],
+ "source": {
+ "discovery": "EXTERNAL"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2026-03-07T07:11:00.000Z",
+ "value": "Report received"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:00:00.000Z",
+ "value": "fixed in 1.6.x by r1936815"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:58:00.000Z",
+ "value": "1.6.4 released"
+ }
+ ],
+ "title": "Apache Portable Runtime Utility: apr-util XML stack recursion crash",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-32327",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
Added: apr/site/trunk/security-json/CVE-2026-34191.json
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ apr/site/trunk/security-json/CVE-2026-34191.json Thu Aug 6 14:37:04 2026 (r1936930)
@@ -0,0 +1,106 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache Portable Runtime Utility",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.6.3",
+ "status": "affected",
+ "version": "1.6.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Elhanan Haenel"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.</p><p>This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3<br></p>"
+ }
+ ],
+ "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3"
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "important"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-89",
+ "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/8xch90zogywwpo5wnsf4o088mkxy4qtf"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2026-03-24T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:00:00.000Z",
+ "value": "fixed in 1.6.x by r1936817"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:58:00.000Z",
+ "value": "1.6.4 released"
+ }
+ ],
+ "title": "Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-34191",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
Added: apr/site/trunk/security-json/CVE-2026-34501.json
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ apr/site/trunk/security-json/CVE-2026-34501.json Thu Aug 6 14:37:04 2026 (r1936930)
@@ -0,0 +1,106 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache Portable Runtime Utility",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.6.3",
+ "status": "affected",
+ "version": "1.6.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Elhanan Haenel"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.</p><p>This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.</p><p>Users are recommended to upgrade to version 1.6.4, which fixes the issue.</p>"
+ }
+ ],
+ "value": "Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.\n\nThis issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.\n\nUsers are recommended to upgrade to version 1.6.4, which fixes the issue."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-122",
+ "description": "CWE-122 Heap-based Buffer Overflow",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/o8h6c7cq86fplxlnry6c3rn9x0ovq8mv"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2026-03-27T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:00:00.000Z",
+ "value": "fixed in 1.6.x by r1936810"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:58:00.000Z",
+ "value": "1.6.4 released"
+ }
+ ],
+ "title": "Apache Portable Runtime Utility: Heap buffer overflow in APR redis client",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-34501",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file
Added: apr/site/trunk/security-json/CVE-2026-34502.json
==============================================================================
--- /dev/null 00:00:00 1970 (empty, because file is newly added)
+++ apr/site/trunk/security-json/CVE-2026-34502.json Thu Aug 6 14:37:04 2026 (r1936930)
@@ -0,0 +1,106 @@
+{
+ "containers": {
+ "cna": {
+ "affected": [
+ {
+ "defaultStatus": "unaffected",
+ "product": "Apache Portable Runtime Utility",
+ "vendor": "Apache Software Foundation",
+ "versions": [
+ {
+ "lessThanOrEqual": "1.6.3",
+ "status": "affected",
+ "version": "1.3.0",
+ "versionType": "semver"
+ }
+ ]
+ }
+ ],
+ "credits": [
+ {
+ "lang": "en",
+ "type": "finder",
+ "value": "Elhanan Haenel"
+ }
+ ],
+ "descriptions": [
+ {
+ "lang": "en",
+ "supportingMedia": [
+ {
+ "base64": false,
+ "type": "text/html",
+ "value": "<p>Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client</p><p>This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.<br></p>"
+ }
+ ],
+ "value": "Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client\n\nThis issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3."
+ }
+ ],
+ "metrics": [
+ {
+ "other": {
+ "content": {
+ "text": "moderate"
+ },
+ "type": "Textual description of severity"
+ }
+ }
+ ],
+ "problemTypes": [
+ {
+ "descriptions": [
+ {
+ "cweId": "CWE-122",
+ "description": "CWE-122 Heap-based Buffer Overflow",
+ "lang": "en",
+ "type": "CWE"
+ }
+ ]
+ }
+ ],
+ "providerMetadata": {
+ "orgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09"
+ },
+ "references": [
+ {
+ "tags": [
+ "vendor-advisory"
+ ],
+ "url": "https://lists.apache.org/thread/spk5643m4vq0mb8h5b9hz9gkp57ombl8"
+ }
+ ],
+ "source": {
+ "discovery": "UNKNOWN"
+ },
+ "timeline": [
+ {
+ "lang": "en",
+ "time": "2026-03-27T12:00:00.000Z",
+ "value": "reported"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:00:00.000Z",
+ "value": "fixed in 1.6.x by r1936813"
+ },
+ {
+ "lang": "en",
+ "time": "2026-08-06T12:58:00.000Z",
+ "value": "1.6.4 released"
+ }
+ ],
+ "title": "Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client",
+ "x_generator": {
+ "engine": "Vulnogram 0.2.0"
+ }
+ }
+ },
+ "cveMetadata": {
+ "assignerOrgId": "f0158376-9dc2-43b6-827c-5f631a4d8d09",
+ "cveId": "CVE-2026-34502",
+ "serial": 1,
+ "state": "PUBLISHED"
+ },
+ "dataType": "CVE_RECORD",
+ "dataVersion": "5.1"
+}
\ No newline at end of file