CVE-2022-25147: Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions
A flaw was found in the Apache Portable Runtime Utility (APR-util) library. This issue may allow a malicious attacker to cause an out-of-bounds write due to an integer overflow when encoding/decoding a very long string using the base64 family of functions.
Other sources
Apache Portable Runtime (APR) could allow a remote attacker to execute arbitrary code on the system, caused by an integer overflow in the aprbase64 functions. By sending a specially-crafted request, an attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system.
— IBM
Integer Overflow or Wraparound vulnerability in aprbase64 functions of Apache Portable Runtime Utility (APR-util) allows an attacker to write beyond bounds of a buffer.
This issue affects Apache Portable Runtime Utility (APR-util) 1.6.1 and prior versions.
— MITRE
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2022-25147?
CVE-2022-25147 is a vulnerability in the Apache Portable Runtime Utility (APR-util) library that allows a remote attacker to execute arbitrary code or cause a denial of service.
How severe is CVE-2022-25147?
CVE-2022-25147 is considered critical with a severity score of 9.8 out of 10.
Which software is affected by CVE-2022-25147?
The affected software includes apr-util 1.6.2, jbcs-httpd24-apr-util 1.6.1-101.el8, jbcs-httpd24-apr-util 1.6.1-101.el7, apr-util 1.5.2-6.el7_9, apr-util 1.6.1-6.el8_8, apr-util 1.6.1-6.el8_1, apr-util 1.6.1-6.el8_2, apr-util 1.6.1-6.el8_4, apr-util 1.6.1-6.el8_6, apr-util 1.6.1-20.el9_2, apr-util 1.6.1-20.el9_0, and IBM QRadar SIEM 7.5.0 - 7.5.0 UP6.
How can CVE-2022-25147 be exploited?
CVE-2022-25147 can be exploited by sending a specially-crafted request to the vulnerable system.
Is there a fix for CVE-2022-25147?
Yes, updating to apr-util version 1.6.2 or applying the recommended patches from the respective software vendors will fix CVE-2022-25147.