Medium
Canonical Ubuntu
Ronald Crane discovered that APR-util did not properly handled memory when encoding or decoding certain input data. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. Update Instructions: Run sudo pro fix USN-5870-1
to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libaprutil1-dbd-odbc – 1.5.4-1ubuntu0.1~esm2 libaprutil1 – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-mysql – 1.5.4-1ubuntu0.1~esm2 libaprutil1-ldap – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-sqlite3 – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-pgsql – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dev – 1.5.4-1ubuntu0.1~esm2 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro
CVEs contained in this USN include: CVE-2022-25147.
Severity is medium unless otherwise noted.
* All versions prior to 0.352.0
* All versions prior to 0.64.0
* All versions prior to 26.5.0
Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:
* Upgrade all versions to 0.352.0 or greater
* Upgrade all versions to 0.64.0 or greater
* Upgrade all versions to 26.5.0 or greater
2023-02-24: Initial vulnerability report published.