Skip to main content

Incorrect Permission Assignment for Critical Resource

CVE-2023-49582

Medium
5.5/10

Summary

Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users to read access to named shared memory segments, potentially revealing sensitive application data. This issue does not affect Non-Unix platforms, or builds with "APR_USE_SHMEM_SHMGET=1" ("apr.h"). This vulnerability affects apr package versions 0.9.0 through 1.7.4. Users are recommended to upgrade, which fixes this issue.

  • LOW
  • LOCAL
  • NONE
  • UNCHANGED
  • NONE
  • LOW
  • HIGH
  • NONE

CWE-732 - Incorrect Permission Assignment for Critical Resource

The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

References

Advisory Timeline

  • Published