svn commit: r1936932 - apr/site/trunk/docs

Author: jorton
Date: Thu Aug  6 14:39:32 2026
New Revision: 1936932

Log:
Regenerate site with fixed CVEs from apr-util 1.6.4.

Modified:
   apr/site/trunk/docs/security_report.html

Modified: apr/site/trunk/docs/security_report.html
==============================================================================
--- apr/site/trunk/docs/security_report.html	Thu Aug  6 14:38:48 2026	(r1936931)
+++ apr/site/trunk/docs/security_report.html	Thu Aug  6 14:39:32 2026	(r1936932)
@@ -106,6 +106,59 @@ the same URL repeatedly).  In general ou
 attacks which can cause the server to consume resources in a non-linear
 relationship to the size of inputs.</p>
 </blockquote>
+<h1 id="1.6.4">Fixed in Apache Portable Runtime Utility 1.6.4</h1><dl>
+
+<dt><h3 id="CVE-2025-49506">low: <name name="CVE-2025-49506">Apache Portable Runtime Utility: apr_password_validate() vulnerable to timing attack</name>
+(<a href="https://www.cve.org/CVERecord?id=CVE-2025-49506">CVE-2025-49506</a>)</h3></dt>
+<dd><p>APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as  Windows, BeOS, NetWare, or Android.</p><p></p><p>Users are recommended to upgrade to version 1.6.4, which fixes this issue.</p>
+<p>Acknowledgements: finder: Michael Rowley &lt;michael csirt.global&gt;</p>
+<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2024-06-03</td></tr>
+<tr><td class="cve-header">fixed in 1.6.x by r1936805</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Update 1.6.4 released</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Affects</td><td class="cve-value">1.2.0 through 1.6.3</td></tr>
+</table></dd>
+<dt><h3 id="CVE-2026-32327">moderate: <name name="CVE-2026-32327">Apache Portable Runtime Utility: apr-util XML stack recursion crash</name>
+(<a href="https://www.cve.org/CVERecord?id=CVE-2026-32327">CVE-2026-32327</a>)</h3></dt>
+<dd><p>A bug in APR-util version 1.6.3 (and earlier) allows a stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function.</p><p></p><p>Users are recommended to upgrade to version 1.6.4, which fixes this issue.</p>
+<p>Acknowledgements:</p>
+<ul>
+<li>finder: Younghyo Cho @ CISLab, SeoulTech</li>
+<li>finder: 4ra1n, pyn3rd and unam4</li>
+</ul>
+<table class="cve"><tr><td class="cve-header">Report received</td><td class="cve-value">2026-03-07</td></tr>
+<tr><td class="cve-header">fixed in 1.6.x by r1936815</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Update 1.6.4 released</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Affects</td><td class="cve-value"> through 1.6.3</td></tr>
+</table></dd>
+<dt><h3 id="CVE-2026-34191">important: <name name="CVE-2026-34191">Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle</name>
+(<a href="https://www.cve.org/CVERecord?id=CVE-2026-34191">CVE-2026-34191</a>)</h3></dt>
+<dd><p>Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider.</p><p></p><p>This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3</p>
+<p>Acknowledgements: finder: Elhanan Haenel</p>
+<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2026-03-24</td></tr>
+<tr><td class="cve-header">fixed in 1.6.x by r1936817</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Update 1.6.4 released</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Affects</td><td class="cve-value">1.6.0 through 1.6.3</td></tr>
+</table></dd>
+<dt><h3 id="CVE-2026-34501">moderate: <name name="CVE-2026-34501">Apache Portable Runtime Utility: Heap buffer overflow in APR redis client</name>
+(<a href="https://www.cve.org/CVERecord?id=CVE-2026-34501">CVE-2026-34501</a>)</h3></dt>
+<dd><p>Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.</p><p></p><p>This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.</p><p></p><p>Users are recommended to upgrade to version 1.6.4, which fixes the issue.</p>
+<p>Acknowledgements: finder: Elhanan Haenel</p>
+<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2026-03-27</td></tr>
+<tr><td class="cve-header">fixed in 1.6.x by r1936810</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Update 1.6.4 released</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Affects</td><td class="cve-value">1.6.0 through 1.6.3</td></tr>
+</table></dd>
+<dt><h3 id="CVE-2026-34502">moderate: <name name="CVE-2026-34502">Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client</name>
+(<a href="https://www.cve.org/CVERecord?id=CVE-2026-34502">CVE-2026-34502</a>)</h3></dt>
+<dd><p>Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client</p><p></p><p>This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.</p>
+<p>Acknowledgements: finder: Elhanan Haenel</p>
+<table class="cve"><tr><td class="cve-header">Reported to security team</td><td class="cve-value">2026-03-27</td></tr>
+<tr><td class="cve-header">fixed in 1.6.x by r1936813</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Update 1.6.4 released</td><td class="cve-value">2026-08-06</td></tr>
+<tr><td class="cve-header">Affects</td><td class="cve-value">1.3.0 through 1.6.3</td></tr>
+</table></dd>
+</dl></br/>
+
 
       </div>
     </div>