crítica
CVE-2022-28331
apr: Windows out-of-bounds write in apr_socket_sendv function
En la Trivy database desde, como mínimo, el 24 oct 2026, 07:11 UTCNo consta cuándo entró antes de ese build.
Severidad por fuente
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Bitnami9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
La etiqueta propia de Trivy es CRITICAL. Crítica según NVD, Bitnami. Más baja según Red Hat (media).
Descripción
On Windows, Apache Portable Runtime 1.7.0 and earlier may write beyond the end of a stack based buffer in apr_socket_sendv(). This is a result of integer overflow.
Paquetes afectados y versiones corregidas
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | apr | 1.7.1 |
| alpine 3.14 | apr | 1.7.1-r0 |
| alpine 3.15 | apr | 1.7.1-r0 |
| alpine 3.16 | apr | 1.7.1-r0 |
| alpine 3.17 | apr | 1.7.1-r0 |
| alpine 3.18 | apr | 1.7.1-r0 |
| alpine 3.19 | apr | 1.7.1-r0 |
| alpine 3.20 | apr | 1.7.1-r0 |
| alpine 3.21 | apr | 1.7.1-r0 |
| alpine 3.22 | apr | 1.7.1-r0 |
| alpine 3.23 | apr | 1.7.1-r0 |
| alpine 3.24 | apr | 1.7.1-r0 |
Mostrar las 14 entradas de 14 fuentes
| Fuente | Paquete | Corregido en |
|---|---|---|
| bitnami::Bitnami Vulnerability Database | apr | 1.7.1 |
| alpine 3.14 | apr | 1.7.1-r0 |
| alpine 3.15 | apr | 1.7.1-r0 |
| alpine 3.16 | apr | 1.7.1-r0 |
| alpine 3.17 | apr | 1.7.1-r0 |
| alpine 3.18 | apr | 1.7.1-r0 |
| alpine 3.19 | apr | 1.7.1-r0 |
| alpine 3.20 | apr | 1.7.1-r0 |
| alpine 3.21 | apr | 1.7.1-r0 |
| alpine 3.22 | apr | 1.7.1-r0 |
| alpine 3.23 | apr | 1.7.1-r0 |
| alpine 3.24 | apr | 1.7.1-r0 |
| alpine edge | apr | 1.7.1-r0 |
| Red Hat | apr | sin corrección indicada |