CVE-2009-1955: apache apr-util

Modified

AliasesDEBIAN-CVE-2009-1955

Published 06-06-2009Last modified 07-08-2024

Vulnerability summary

CVE-2009-1955 is a high (CVSS 7.5) vulnerability in apache apr-util. EPSS estimates a 52.99% chance of exploitation in the next 30 days, higher than 98.9% of scored vulnerabilities. 1 public exploit is recorded.

Priority

Prioritisepublic exploit

Public exploit (exploit-database, 01-06-2009)

Source freshness unavailable

How is this decided?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

52.99%

0%100%

Critical · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 6 · Related 1

DSA-1812-1 OPENSUSE-SU-2024:10268-1 RHSA-2009:1107 RHSA-2009:1108 RHSA-2009:1160 RHSA-2010:0602

Timeline

06-06-2009
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

The expat XML parser in the apr_xml_* interface in xml/apr_xml.c in Apache APR-util before 1.3.7, as used in the mod_dav and mod_dav_svn modules in the Apache HTTP Server, allows remote attackers to cause a denial of service (memory consumption) via a crafted XML document containing a large number of nested entity references, as demonstrated by a PROPFIND request, a similar issue to CVE-2003-1564.

CVSS metrics

3 scores · 2 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

52.99%

Chance of exploitation in the next 30 days

Percentile

99%

Versus all other CVEs

30-day change

No change 0.00 pp

From 52.99% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found

exploit-databasedosmultipleVerified
Apache mod_dav / svn - Remote Denial of Service
Maturity: poc

Weaknesses

CWE · root cause

CWE-776Improper Restriction of Recursive Entity References in DTDsThe product uses XML documents and allows their structure to be defined with a Document Type Definition (DTD), but it does not properly control the number of recursive definitions of entities.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Apache2 products

apr-util< 1.3.7
http_server≥ 2.2.0, < 2.2.12

Debian2 products

apr-util< 1.3.7+dfsg-1
debian_linuxEOL4.0

Apple1 product

mac_os_x< 10.6.2

Canonical1 product

ubuntu_linuxEOL6.06 | 8.04 | 8.10 | 9.04

Fedoraproject1 product

fedoraEOL9 | 10 | 11

Oracle1 product

http_serverna

Suse1 product

linux_enterprise_server9

7 vendors · 9 products

References

61 links

secunia.com/advisories/35487Third Party AdvisoryX Refsource SECUNIABroken Link
www.debian.org/security/2009/dsa-1812Vendor AdvisoryX Refsource DEBIANMailing ListThird Party Advisory
www.apache.org/dist/apr/CHANGES-APR-UTIL-1.3X Refsource CONFIRMBroken Link
www.vupen.com/english/advisories/2009/1907VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
www.redhat.com/archives/fedora-package-announce/2009-June/msg01228.htmlVendor AdvisoryX Refsource FEDORAMailing List
secunia.com/advisories/35444Third Party AdvisoryX Refsource SECUNIABroken Link
marc.info?l=apr-dev&m=124396021826125&w=2Mailing ListX Refsource MLISTPatch
www.mandriva.com/security/advisories?name=MDVSA-2009:131Vendor AdvisoryX Refsource MANDRIVABroken LinkThird Party Advisory
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10270VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
secunia.com/advisories/35360Third Party AdvisoryX Refsource SECUNIABroken Link

Show all 61 references

www.vupen.com/english/advisories/2010/1107VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
www.openwall.com/lists/oss-security/2009/06/03/4Mailing ListX Refsource MLIST
secunia.com/advisories/35395Third Party AdvisoryX Refsource SECUNIABroken Link
www-01.ibm.com/support/docview.wss?uid=swg1PK99478Vendor AdvisoryX Refsource AIXAPARBroken LinkThird Party Advisory
www.securityfocus.com/archive/1/506053/100/0/threadedMailing ListX Refsource BUGTRAQBroken LinkThird Party AdvisoryVDB Entry
lists.opensuse.org/opensuse-security-announce/2010-05/msg00001.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/35284Third Party AdvisoryX Refsource SECUNIABroken Link
www-01.ibm.com/support/docview.wss?uid=swg1PK91241Vendor AdvisoryX Refsource AIXAPARBroken LinkThird Party Advisory
secunia.com/advisories/36473Third Party AdvisoryX Refsource SECUNIABroken Link
www-01.ibm.com/support/docview.wss?uid=swg1PK88342Vendor AdvisoryX Refsource AIXAPARBroken Link
secunia.com/advisories/35843Third Party AdvisoryX Refsource SECUNIABroken Link
www.redhat.com/archives/fedora-package-announce/2009-June/msg01173.htmlVendor AdvisoryX Refsource FEDORAMailing List
www.redhat.com/support/errata/RHSA-2009-1108.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
marc.info?l=bugtraq&m=129190899612998&w=2Vendor AdvisoryX Refsource HPMailing List
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12473VDB EntrySignatureX Refsource OVALBroken LinkThird Party Advisory
secunia.com/advisories/35797Third Party AdvisoryX Refsource SECUNIABroken Link
www.oracle.com/technetwork/topics/security/cpuapr2013-1899555.htmlX Refsource CONFIRMPatchThird Party Advisory
security.gentoo.org/glsa/glsa-200907-03.xmlVendor AdvisoryX Refsource GENTOOThird Party Advisory
svn.apache.org/viewvc?view=rev&revision=781403X Refsource CONFIRMPatch
www.redhat.com/archives/fedora-package-announce/2009-June/msg01201.htmlVendor AdvisoryX Refsource FEDORAMailing List
www.ubuntu.com/usn/usn-786-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/34724Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/37221Third Party AdvisoryX Refsource SECUNIABroken Link
secunia.com/advisories/35565Third Party AdvisoryX Refsource SECUNIABroken Link
www.vupen.com/english/advisories/2009/3184VDB EntryX Refsource VUPENBroken LinkThird Party Advisory
wiki.rpath.com/Advisories:rPSA-2009-0123X Refsource CONFIRMBroken Link
www.exploit-db.com/exploits/8842ExploitX Refsource EXPLOIT DBVDB Entry
slackware.com/security/viewer.php?l=slackware-security&y=2009&m=slackware-security.538210Vendor AdvisoryX Refsource SLACKWAREBroken LinkThird Party Advisory
www-01.ibm.com/support/docview.wss?uid=swg27014463X Refsource CONFIRMBroken LinkThird Party Advisory
lists.apple.com/archives/security-announce/2009/Nov/msg00000.htmlVendor AdvisoryX Refsource APPLEMailing ListThird Party Advisory
www.mandriva.com/security/advisories?name=MDVSA-2013:150Vendor AdvisoryX Refsource MANDRIVABroken LinkThird Party Advisory
secunia.com/advisories/35710Third Party AdvisoryX Refsource SECUNIABroken Link
www.securityfocus.com/bid/35253VDB EntryX Refsource BIDBroken LinkThird Party Advisory
www.redhat.com/support/errata/RHSA-2009-1107.htmlVendor AdvisoryX Refsource REDHATBroken LinkThird Party Advisory
support.apple.com/kb/HT3937X Refsource CONFIRMBroken Link
www.ubuntu.com/usn/usn-787-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
lists.apache.org/thread.html/…Mailing ListX Refsource MLISTPatch
security-tracker.debian.org/tracker/CVE-2009-1955Advisory