You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@apr.apache.org by co...@apache.org on 2024/08/26 13:38:01 UTC

svn commit: r71103 - /release/apr/CHANGES-APR-1.7

Author: covener
Date: Mon Aug 26 13:38:01 2024
New Revision: 71103

Log:
add CVE for release


Modified:
    release/apr/CHANGES-APR-1.7

Modified: release/apr/CHANGES-APR-1.7
==============================================================================
--- release/apr/CHANGES-APR-1.7 (original)
+++ release/apr/CHANGES-APR-1.7 Mon Aug 26 13:38:01 2024
@@ -1,6 +1,18 @@
                                                      -*- coding: utf-8 -*-
 Changes for APR 1.7.5
 
+  *) SECURITY: CVE-2023-49582: Apache Portable Runtime (APR):
+     Unexpected lax shared memory permissions (cve.mitre.org)
+     Lax permissions set by the Apache Portable Runtime library on
+     Unix platforms would allow local users read access to named
+     shared memory segments, potentially revealing sensitive
+     application data.
+     This issue does not affect non-Unix platforms, or builds with
+     APR_USE_SHMEM_SHMGET=1 (apr.h)
+     Users are recommended to upgrade to APR version 1.7.5, which
+     fixes this issue.
+     Credits: Thomas Stangner
+
   *) Unix: Implement apr_shm_perms_set() for the "POSIX shm_open()"
      and "classic mmap" shared memory implementations.  [Joe Orton,
      Ruediger Pluem]