CVE-2022-25147
Description
A flaw was found in the Apache Portable Runtime Utility (APR-util) library. This issue may allow a malicious attacker to cause an out-of-bounds write due to an integer overflow when encoding/decoding a very long string using the base64 family of functions.
Statement
The Apache Portable Runtime Utility (APR-util) library contains additional utility interfaces for APR (Apache Portable Runtime). This vulnerability is related to the incorrect usage of the base64 encoding/decoding family of functions through APR-util API. Usage of these functions with long enough string would cause integer overflow and will lead to out-of-bound write.
This flaw was rated with an important severity for a moment as Red Hat received information that this vulnerability potentially can allow remote attackers to cause a denial of service to the application linked to the APR-util library. Deep analysis confirmed that there are no known conditions that could lead to DoS. Additionally the APR-util API should not be exposed to the untrusted uploads and usage.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.5 | 6.5 | N/A |
| Attack Vector | Network | Network | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | None | None | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | Low | Low | N/A |
| Availability Impact | Low | Low | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
NVD: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
Red Hat CVSS v3 Score Explanation
This vulnerability does not have direct impact on the Confidentiality of the data as it's related to the out-of-bound write weakness in the base64 encoding/decoding function. Hence the Confidentiality (C) metric is set to None. A potential attacker by uploading a long enough string and causing integer overflow in the base64 encoding/decoding function, that leads to an out-of-bound write, may impact data integrity of the software that uses vulnerable apr-util API, but the attacker does not have control over the consequence of a modification, hence the Integrity metric is Low. Due to the nature of this vulnerability the attacker also does not have the ability to completely deny service and any control of the consequence of successful exploitation. Hence the Availability metric value is Low.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
