What’s Vulnerable › Vulnerabilities

CVE-2023-49582: Apache Portable Runtime (APR): Unexpected lax shared memory permissions

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-08-26 · updated 2026-06-17
• Weakness: CWE-732

Description

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h) Users are recommended to upgrade to APR version 1.7.5, which fixes this issue.

Affected products

• Apache Software Foundation Apache Portable Runtime (APR): from 0.9.0 before 1.7.5 — fixed in 1.7.5

How to fix

Upgrade to a fixed version: Apache Software Foundation Apache Portable Runtime (APR) 1.7.5. Check the vendor advisory for mitigations.

References

• https://lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zdnmv7dc4
• http://www.openwall.com/lists/oss-security/2024/08/26/1
• https://security.netapp.com/advisory/ntap-20241101-0004/

Get alerted when CVE-2023-49582 or the next vulnerability affects your stack