{"schemaVersion":3,"id":"CVE-2023-49582","aliases":["ALPINE-CVE-2023-49582","MGASA-2024-0292","SUSE-SU-2024:3428-1","SUSE-SU-2024:3429-1","UBUNTU-CVE-2023-49582","USN-7038-1","USN-7038-2","DEBIAN-CVE-2023-49582","openSUSE-SU-2024:14347-1"],"status":"published","duplicateOf":null,"title":null,"description":"Lax permissions set by the Apache Portable Runtime library on Unix platforms would allow local users read access to named shared memory segments, potentially revealing sensitive application data.\n\nThis issue does not affect non-Unix platforms, or builds with APR_USE_SHMEM_SHMGET=1 (apr.h)\n\nUsers are recommended to upgrade to APR version 1.7.5, which fixes this issue.","dates":{"published":"2024-08-26T14:03:44.588Z","modified":"2025-03-13T14:25:56.517Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":5.5,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Alpine","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":4.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":5.5,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.00332,"percentile":0.24967,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.00332},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00332,"percentile":0.24967}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.00332,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.00332,"percentile":0.24967}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-732","name":"Incorrect Permission Assignment for Critical Resource","description":"The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.","type":"weakness","status":"Draft","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/732.html"}],"affected":[{"vendor":"apache software foundation","product":"apache portable runtime (apr)","name":"Apache Portable Runtime (APR)","label":"apache portable runtime (apr)","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.9.0, ≤ 1.7.4","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.9.0, ≤ 1.7.4","eol":null,"hubHref":"/vendor/apache_software_foundation/apache_portable_runtime_apr"},{"vendor":"apache","product":"portable_runtime","name":"portable runtime","label":"portable_runtime","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"≥ 0.9.0, < 1.7.5","noFixRecorded":false,"fixedIn":null}],"versionsText":"≥ 0.9.0, < 1.7.5","eol":null,"hubHref":"/vendor/apache/portable_runtime"},{"vendor":"alpine","product":"apr","name":"apr","label":"apr","ecosystem":"Alpine Linux","cpePart":null,"purl":"pkg:apk/alpine/apr","purlType":"apk","versions":[{"text":"< 1.7.5-r0","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.5-r0","eol":null,"hubHref":null},{"vendor":"debian","product":"apr","name":"apr","label":"apr","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/apr","purlType":"deb","versions":[{"text":"< 1.7.2-3+deb12u1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.7.5-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.2-3+deb12u1 | < 1.7.5-1","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"apr","name":"apr","label":"apr","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/apr","purlType":"deb","versions":[{"text":"< 1.5.2-3ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.6.3-2ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.6.5-1ubuntu1.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.7.0-8ubuntu0.22.04.2","noFixRecorded":false,"fixedIn":null},{"text":"< 1.7.2-3.1ubuntu0.1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.5.0-1ubuntu0.1~esm2","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.2-3ubuntu0.1~esm2 | < 1.6.3-2ubuntu0.1~esm1 | < 1.6.5-1ubuntu1.1 | < 1.7.0-8ubuntu0.22.04.2 | < 1.7.2-3.1ubuntu0.1 | < 1.5.0-1ubuntu0.1~esm2","eol":null,"hubHref":null},{"vendor":"mageia","product":"apr","name":"apr","label":"apr","ecosystem":"Mageia","cpePart":null,"purl":"pkg:rpm/mageia/apr","purlType":"rpm","versions":[{"text":"< 1.7.5-1.mga9","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.5-1.mga9","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apr&distro=openSUSE Leap 15.5","name":"apr","label":"apr&distro=openSUSE Leap 15.5","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apr&distro=openSUSE Leap 15.5","purlType":"rpm","versions":[{"text":"< 1.6.3-150000.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.3-150000.3.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apr&distro=openSUSE Leap 15.6","name":"apr","label":"apr&distro=openSUSE Leap 15.6","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apr&distro=openSUSE Leap 15.6","purlType":"rpm","versions":[{"text":"< 1.6.3-150000.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.3-150000.3.6.1","eol":null,"hubHref":null},{"vendor":"opensuse","product":"apr&distro=openSUSE Tumbleweed","name":"apr","label":"apr&distro=openSUSE Tumbleweed","ecosystem":"openSUSE","cpePart":null,"purl":"pkg:rpm/opensuse/apr&distro=openSUSE Tumbleweed","purlType":"rpm","versions":[{"text":"< 1.7.5-1.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.7.5-1.1","eol":null,"hubHref":null},{"vendor":"suse","product":"apr&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","name":"apr","label":"apr&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apr&distro=SUSE Linux Enterprise Module for Basesystem 15 SP5","purlType":"rpm","versions":[{"text":"< 1.6.3-150000.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.3-150000.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"apr&distro=SUSE Linux Enterprise Module for Basesystem 15 SP6","name":"apr","label":"apr&distro=SUSE Linux Enterprise Module for Basesystem 15 SP6","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/apr&distro=SUSE Linux Enterprise Module for Basesystem 15 SP6","purlType":"rpm","versions":[{"text":"< 1.6.3-150000.3.6.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.6.3-150000.3.6.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libapr1&distro=SUSE Linux Enterprise Server 12 SP5","name":"libapr1","label":"libapr1&distro=SUSE Linux Enterprise Server 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libapr1&distro=SUSE Linux Enterprise Server 12 SP5","purlType":"rpm","versions":[{"text":"< 1.5.1-4.8.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.1-4.8.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libapr1&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","name":"libapr1","label":"libapr1&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libapr1&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP5","purlType":"rpm","versions":[{"text":"< 1.5.1-4.8.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.1-4.8.1","eol":null,"hubHref":null},{"vendor":"suse","product":"libapr1&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","name":"libapr1","label":"libapr1&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","ecosystem":"SUSE Linux Enterprise","cpePart":null,"purl":"pkg:rpm/suse/libapr1&distro=SUSE Linux Enterprise Software Development Kit 12 SP5","purlType":"rpm","versions":[{"text":"< 1.5.1-4.8.1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.5.1-4.8.1","eol":null,"hubHref":null}],"affectedCount":14,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zdnmv7dc4","label":"lists.apache.org/thread/sntjc04t1rvjhdzz2tzmtz2zdnmv7dc4","hostname":"lists.apache.org","tags":["Vendor Advisory","REPORT","Mailing List"]},{"url":"http://www.openwall.com/lists/oss-security/2024/08/26/1","label":"www.openwall.com/lists/oss-security/2024/08/26/1","hostname":"www.openwall.com","tags":[]},{"url":"https://security.netapp.com/advisory/ntap-20241101-0004/","label":"security.netapp.com/advisory/ntap-20241101-0004/","hostname":"security.netapp.com","tags":[]},{"url":"https://security.alpinelinux.org/vuln/CVE-2023-49582","label":"security.alpinelinux.org/vuln/CVE-2023-49582","hostname":"security.alpinelinux.org","tags":["Advisory"]},{"url":"https://advisories.mageia.org/MGASA-2024-0292.html","label":"advisories.mageia.org/MGASA-2024-0292.html","hostname":"advisories.mageia.org","tags":["Advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=33514","label":"bugs.mageia.org/show_bug.cgi?id=33514","hostname":"bugs.mageia.org","tags":["REPORT"]},{"url":"https://openwall.com/lists/oss-security/2024/08/26/1","label":"openwall.com/lists/oss-security/2024/08/26/1","hostname":"openwall.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243428-1/","label":"www.suse.com/support/update/announcement/2024/suse-su-20243428-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://bugzilla.suse.com/1229783","label":"bugzilla.suse.com/1229783","hostname":"bugzilla.suse.com","tags":["REPORT"]},{"url":"https://www.suse.com/security/cve/CVE-2023-49582","label":"www.suse.com/security/cve/CVE-2023-49582","hostname":"www.suse.com","tags":["WEB"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20243429-1/","label":"www.suse.com/support/update/announcement/2024/suse-su-20243429-1/","hostname":"www.suse.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2023-49582","label":"ubuntu.com/security/CVE-2023-49582","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49582","label":"www.cve.org/CVERecord?id=CVE-2023-49582","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://www.openwall.com/lists/oss-security/2024/08/26/1","label":"www.openwall.com/lists/oss-security/2024/08/26/1","hostname":"www.openwall.com","tags":["REPORT"]},{"url":"https://lists.apache.org/thread/h5f1c2dqm8bf5yfosw3rg85927p612l0","label":"lists.apache.org/thread/h5f1c2dqm8bf5yfosw3rg85927p612l0","hostname":"lists.apache.org","tags":["REPORT"]},{"url":"https://ubuntu.com/security/notices/USN-7038-1","label":"ubuntu.com/security/notices/USN-7038-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7038-2","label":"ubuntu.com/security/notices/USN-7038-2","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-49582","label":"security-tracker.debian.org/tracker/CVE-2023-49582","hostname":"security-tracker.debian.org","tags":["Advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ALSQL5AZ2RWJR4M6G3BLHFNVQ2ISR7NC/","label":"lists.opensuse.org/archives/…","hostname":"lists.opensuse.org","tags":["Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49582","label":"nvd.nist.gov/vuln/detail/CVE-2023-49582","hostname":"nvd.nist.gov","tags":["Oval","Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2024-08-26T14:03:44.588Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2025-03-13T14:25:56.517Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":22,"level":"low","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T12:18:33.794Z","stale":false,"partial":false}}