Описание
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client.
This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3.
Users are recommended to upgrade to version 1.6.4, which fixes the issue.
A flaw was found in the Redis client in the Apache Portable Runtime Utility (apr-util). A heap buffer overflow can be triggered when the application processes a specially crafted response from a Redis server, resulting in a crash and denial of service.
Отчет
The impact of this vulnerability is rated as Moderate. Although the flaw involves a heap buffer overflow and the CVSS base score reflects an unauthenticated network vector, exploitation requires the attacker to control or compromise the Redis server that the application queries. An attacker cannot trigger this condition by sending data directly to the affected application — they must first be in a position to influence Redis responses, either by compromising the Redis backend or performing a man-in-the-middle attack on the connection. Additionally, the overflow does not result in arbitrary code execution; the observed impact is limited to a denial of service. This prerequisite significantly limits real-world exploitability.
Меры по смягчению последствий
Ensure that the Redis server used by the application is deployed in a trusted, network-segregated environment and is not accessible to untrusted parties. Where possible, configure authentication and TLS on the Redis connection to reduce the risk of a compromised or spoofed Redis server.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | apr-util | Affected | ||
| Red Hat Enterprise Linux 6 | apr-util | Out of support scope | ||
| Red Hat Enterprise Linux 7 | apr-util | Affected | ||
| Red Hat Enterprise Linux 8 | apr-util | Affected | ||
| Red Hat Enterprise Linux 9 | apr-util | Affected | ||
| Red Hat Hardened Images | apr-util | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
Apache Portable Runtime Utility: Heap buffer overflow in APR redis client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Ut ...
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. This issue affects Apache Portable Runtime Utility: from 1.6.0 through 1.6.3. Users are recommended to upgrade to version 1.6.4, which fixes the issue.
EPSS
7.5 High
CVSS3