Amazon Linux 2023: CVE-2022-24963: Critical priority package update for apr

Amazon Linux 2023: CVE-2022-24963: Critical priority package update for apr

Severity

6

CVSS

(AV:N/AC:L/Au:N/C:N/I:P/A:P)

Published

01/31/2023

Created

02/14/2025

Added

02/14/2025

Modified

02/14/2025

Description

Integer Overflow or Wraparound vulnerability in apr_encode functions of Apache Portable Runtime (APR) allows an attacker to write beyond bounds of a buffer. This issue affects Apache Portable Runtime (APR) version 1.7.0. A flaw was found in Apache Portable Runtime (APR). This issue may allow a malicious attacker to write beyond the bounds of a buffer.

Solution(s)

• amazon-linux-2023-upgrade-apr
• amazon-linux-2023-upgrade-apr-debuginfo
• amazon-linux-2023-upgrade-apr-debugsource
• amazon-linux-2023-upgrade-apr-devel

References

• https://attackerkb.com/topics/cve-2022-24963
• CVE - 2022-24963
• https://alas.aws.amazon.com/AL2023/ALAS-2023-016.html