CVE-2022-25147: Apache Portable Runtime Utility (APR-util): out-of-bounds writes in the apr_base64 family of functions
A flaw was found in the Apache Portable Runtime Utility (APR-util) library. This issue may allow a malicious attacker to cause an out-of-bounds write due to an integer overflow when encoding/decoding a very long string using the base64 family of functions.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-25147?
CVE-2022-25147 is a vulnerability in the Apache Portable Runtime Utility (APR-util) library that allows a remote attacker to execute arbitrary code or cause a denial of service.
How severe is CVE-2022-25147?
CVE-2022-25147 is considered critical with a severity score of 9.8 out of 10.
Which software is affected by CVE-2022-25147?
The affected software includes apr-util 1.6.2, jbcs-httpd24-apr-util 1.6.1-101.el8, jbcs-httpd24-apr-util 1.6.1-101.el7, apr-util 1.5.2-6.el7_9, apr-util 1.6.1-6.el8_8, apr-util 1.6.1-6.el8_1, apr-util 1.6.1-6.el8_2, apr-util 1.6.1-6.el8_4, apr-util 1.6.1-6.el8_6, apr-util 1.6.1-20.el9_2, apr-util 1.6.1-20.el9_0, and IBM QRadar SIEM 7.5.0 - 7.5.0 UP6.
How can CVE-2022-25147 be exploited?
CVE-2022-25147 can be exploited by sending a specially-crafted request to the vulnerable system.
Is there a fix for CVE-2022-25147?
Yes, updating to apr-util version 1.6.2 or applying the recommended patches from the respective software vendors will fix CVE-2022-25147.