USN-5870-1: apr-util vulnerability

Severity

Medium

Vendor

Canonical Ubuntu

Versions Affected

• Canonical Ubuntu 16.04
• Canonical Ubuntu 18.04
• Canonical Ubuntu 22.04

Description

Ronald Crane discovered that APR-util did not properly handled memory when encoding or decoding certain input data. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. Update Instructions: Run `sudo pro fix USN-5870-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libaprutil1-dbd-odbc – 1.5.4-1ubuntu0.1~esm2 libaprutil1 – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-mysql – 1.5.4-1ubuntu0.1~esm2 libaprutil1-ldap – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-sqlite3 – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-pgsql – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dev – 1.5.4-1ubuntu0.1~esm2 Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro

CVEs contained in this USN include: CVE-2022-25147.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

• cflinuxfs3

• • All versions prior to 0.352.0

• cflinuxfs4

• • All versions prior to 0.64.0

• CF Deployment

• • All versions prior to 26.5.0

Mitigation

Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

• cflinuxfs3

• • Upgrade all versions to 0.352.0 or greater

• cflinuxfs4

• • Upgrade all versions to 0.64.0 or greater

• CF Deployment

• • Upgrade all versions to 26.5.0 or greater

References

• USN Notice
• CVE-2022-25147

History

2023-02-24: Initial vulnerability report published.