Integer overflow in Apache Portable Runtime - CVE-2022-24963

Vulnerability identifier: #VU71752

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-24963

CWE-ID: CWE-190

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to integer overflow within the apr_encode() function. A remote attacker can pass specially crafted data to the application, trigger integer overflow and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Apache Portable Runtime
Amazon Linux AMI
Debian Linux
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Oracle Solaris
Slackware Linux
openEuler
Ubuntu
JBoss Web Server
jws5-tomcat-native (Red Hat package)
jbcs-httpd24-mod_proxy_cluster (Red Hat package)
jbcs-httpd24-apr-util (Red Hat package)
apr
apr-debuginfo
apr-devel
apr-debugsource
apr-help
apr (Debian package)
jbcs-httpd24-apr (Red Hat package)
libapr1 (Ubuntu package)
apr (Red Hat package)
jbcs-httpd24-mod_http2 (Red Hat package)
jbcs-httpd24-mod_md (Red Hat package)
jbcs-httpd24-httpd (Red Hat package)
jbcs-httpd24-mod_security (Red Hat package)
jbcs-httpd24-curl (Red Hat package)
jws5-tomcat (Red Hat package)
JBoss Core Services
Cloud Pak for Network Automation
Isolation Segment
VMware Tanzu Application Service for VMs
Red Hat OpenShift Dev Spaces
Red Hat Migration Toolkit for Applications
Red Hat OpenShift Container Platform
PowerScale OneFS

Install updates from vendor's website.

Apache Portable Runtime - update to 1.7.1
JBoss Web Server - update to 5.7.4
jws5-tomcat-native (Red Hat package) - addressed in versions 1.2.31-15.redhat_15.el7jws, 1.2.31-15.redhat_15.el8jws, 1.2.31-15.redhat_15.el9jws
jbcs-httpd24-mod_proxy_cluster (Red Hat package) - addressed in versions 1.3.19-4.el7jbcs, 1.3.19-4.el8jbcs
jbcs-httpd24-apr-util (Red Hat package) - addressed in versions 1.6.1-102.el7jbcs, 1.6.1-102.el8jbcs
apr - addressed in versions 1.7.0-4, 1.7.0-5, 1.7.0-6
apr-debuginfo - addressed in versions 1.7.0-4, 1.7.0-5, 1.7.0-6
apr-devel - addressed in versions 1.7.0-4, 1.7.0-5, 1.7.0-6
apr-debugsource - addressed in versions 1.7.0-4, 1.7.0-5, 1.7.0-6
apr-help - addressed in versions 1.7.0-4, 1.7.0-5, 1.7.0-6
apr (Debian package) - update to 1.7.0-6+deb11u2
jbcs-httpd24-apr (Red Hat package) - addressed in versions 1.7.0-8.el7jbcs, 1.7.0-8.el8jbcs
libapr1 (Ubuntu package) - addressed in versions 1.7.0-8ubuntu0.22.04.1, 1.7.0-8ubuntu0.22.10.1
apr-devel - update to 1.7.0-12
apr - update to 1.7.0-12
apr (Red Hat package) - update to 1.7.0-12.el9_3
apr - update to 1.7.2
apr - update to 1.7.2-2
jbcs-httpd24-mod_http2 (Red Hat package) - addressed in versions 1.15.19-28.el7jbcs, 1.15.19-28.el8jbcs
jbcs-httpd24-mod_md (Red Hat package) - addressed in versions 2.4.0-25.el7jbcs, 2.4.0-25.el8jbcs
JBoss Core Services - update to 2.4.57
jbcs-httpd24-httpd (Red Hat package) - addressed in versions 2.4.57-5.el7jbcs, 2.4.57-5.el8jbcs
Cloud Pak for Network Automation - update to 2.7
jbcs-httpd24-mod_security (Red Hat package) - addressed in versions 2.9.3-29.el7jbcs, 2.9.3-29.el8jbcs
Isolation Segment - addressed in versions 3.0.8, 4.0.0
VMware Tanzu Application Service for VMs - addressed in versions 3.0.8, 4.0.0
Red Hat OpenShift Dev Spaces - update to 3.16.0
Red Hat OpenShift Container Platform - addressed in versions 4.16.15, 4.17.0
Red Hat Migration Toolkit for Applications - update to 6.2
jbcs-httpd24-curl (Red Hat package) - addressed in versions 8.2.1-1.el7jbcs, 8.2.1-1.el8jbcs
jws5-tomcat (Red Hat package) - addressed in versions 9.0.62-15.redhat_00013.1.el7jws, 9.0.62-15.redhat_00013.1.el8jws, 9.0.62-15.redhat_00013.1.el9jws
PowerScale OneFS - update to 9.4.0.14

• https://lists.apache.org/thread/fw9p6sdncwsjkstwc066vz57xqzfksq9
• https://archive.apache.org/dist/apr/CHANGES-APR-1.7

• Remote code execution in Apache Portable Runtime
• Slackware Linux update for apr
• Ubuntu update for apr
• Debian update for apr
• Multiple vulnerabilities in Oracle Solaris third-party software
• VMware Tanzu products update for APR
• Multiple vulnerabilities in Dell EMC PowerScale OneFS
• Multiple vulnerabilities in Red Hat JBoss Core Services
• Multiple vulnerabilities in Red Hat JBoss Web Server 5.7
• Multiple vulnerabilities in JBoss Enterprise Web Server 5 for RHEL 8
• Red Hat Enterprise Linux 9 update for apr
• Multiple vulnerabilities in Red Hat Migration Toolkit for Applications
• Multiple vulnerabilities in IBM Cloud Pak for Network Automation
• openEuler 20.03 LTS SP1 update for apr
• openEuler 20.03 LTS SP3 update for apr
• openEuler 22.03 LTS SP1 update for apr
• openEuler 22.03 LTS update for apr
• Amazon Linux AMI update for apr
• Multiple vulnerabilities in Red Hat OpenShift Dev Spaces
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.16
• Multiple vulnerabilities in Red Hat OpenShift Container Platform 4.17
• Anolis OS update for apr