CVE-2022-28331 Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function
An integer overflow in the APR library on Windows allows out-of-bounds writes, potentially enabling remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-28331?
CVE-2022-28331 is a critical vulnerability in Apache Portable Runtime (APR), published on 31 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
Weakness: CWE-190
Which versions are affected by CVE-2022-28331?
1 open source package ship an affected version, including apr. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
apr Bitnami | All versions | 1.7.1 |
Products include Apache Portable Runtime.
How do I fix CVE-2022-28331?
Upgrade apr to 1.7.1 or later.
Is CVE-2022-28331 being exploited?
There is no known exploitation of CVE-2022-28331 in the wild and no public exploit code.
Other vulnerabilities in Apache Portable Runtime (APR)
- CVE-2022-24963 Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions
- CVE-2021-35940 Regression of CVE-2017-12613
- CVE-2017-12613 Information disclosure in Apache Portable Runtime
- CVE-2023-49582 Apache Portable Runtime (APR): Unexpected lax shared memory permissions
- CVE-2012-0840 Denial of service in n/a
Sources
Also known as ALPINE-CVE-2022-28331, BIT-apr-2022-28331, GHSA-27j5-c395-8j82.