Описание
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client
This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
A flaw was found in the memcached client in the Apache Portable Runtime Utility (apr-util). A remote, unauthenticated attacker can cause the application to crash or become unresponsive by sending a specially crafted response from a malicious or compromised memcached server, resulting in a denial of service.
Отчет
The impact of this vulnerability is rated as Moderate. While the flaw is network-reachable and requires no authentication against the application itself, exploitation depends on the attacker controlling or compromising the memcached server that the application queries. An attacker cannot trigger the denial of service by sending data directly to the affected application — they must first be in a position to influence memcached responses, either by compromising the memcached backend or performing a man-in-the-middle attack on the connection between the application and memcached. This prerequisite significantly limits the real-world exploitability compared to a direct network denial-of-service attack.
Меры по смягчению последствий
Restrict network access for applications that use the apr-util memcached client to communicate only with trusted memcached servers. Ensure that Red Hat products are configured to avoid connecting to untrusted or publicly exposed memcached instances. If the memcached client functionality is not essential, consider disabling or removing any dependent components. A service restart may be required for changes to take effect.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | apr-util | Affected | ||
| Red Hat Enterprise Linux 6 | apr-util | Out of support scope | ||
| Red Hat Enterprise Linux 7 | apr-util | Affected | ||
| Red Hat Enterprise Linux 8 | apr-util | Affected | ||
| Red Hat Enterprise Linux 9 | apr-util | Affected | ||
| Red Hat Hardened Images | apr-util | Affected |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS3
Связанные уязвимости
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
Apache Portable Runtime Utility: Heap buffer overflow in APR memcached client
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Ut ...
Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client This issue affects Apache Portable Runtime Utility: from 1.3.0 through 1.6.3.
7.5 High
CVSS3