Regression of CVE-2017-12613
Priority LOW 34CWE-125Published · Updated
Key facts
- Attack vector
- Local
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
An out-of-bounds array read in the apr_time_exp*() functions was fixed in the Apache Portable Runtime 1.6.3 release (CVE-2017-12613). The fix for this issue was not carried forward to the APR 1.7.x branch, and hence version 1.7.0 regressed compared to 1.6.3 and is vulnerable to the same issue.
Why it matters now
EPSS 0.01185 68th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Portable Runtime (APR) | Apache Portable Runtime 1.7.0 | — | No fix listed | CNA |
- Apache Portable Runtime (APR) VendorApache Affected Apache Portable Runtime 1.7.0 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 7 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Core Services
- Red Hat JBoss Web Server 3
- Red Hat JBoss Web Server 5
Timeline
- 2026-10-02 Threatist record created from CVE-2021-35940
- 2026-10-03 Alias added: GHSA-95qq-4mqm-pp5g
References
Patch 2
Advisory 3
Other 11
- http://mail-archives.apache.org/mod_mbox/www-announce/201710.mbox/%3CCACsi251B8UaLvM-rrH9fv57-zWi0zhyF3275_jPg1a9VEVVoxw%40mail.gmail.com%3E
- [announce] 20210823 CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613
- [apr-dev] 20210831 APR 1.7.1 release?
- [httpd-dev] 20210831 APR 1.7.1 release?
- [apr-dev] 20210831 Re: APR 1.7.1 release?
- [apr-dev] 20210901 Re: APR 1.7.1 release?
- [apr-dev] 20210916 Re: CVE-2021-35940: Apache Portable Runtime (APR): Regression of CVE-2017-12613
- [tomcat-dev] 20210922 [jira] [Created] (MTOMCAT-327) Tomcat 9.0.50 and it has apr-1.7.0 dependency, with Address CVE-2021-35940
- [tomcat-dev] 20210922 [jira] [Resolved] (MTOMCAT-327) Tomcat 9.0.50 and it has apr-1.7.0 dependency, with Address CVE-2021-35940
- [tomcat-dev] 20210922 [jira] [Commented] (MTOMCAT-327) Tomcat 9.0.50 and it has apr-1.7.0 dependency, with Address CVE-2021-35940
- [tomcat-dev] 20210922 [jira] [Reopened] (MTOMCAT-327) Tomcat 9.0.50 and it has apr-1.7.0 dependency, with Address CVE-2021-35940
More Apache Portable Runtime vulnerabilities
- TI-2009-02302 Multiple integer overflows in the Apache Portable Runtime (APR) library and the Apache… CVSS 2.0HIGH 10.0
- TI-2022-11103 Apache Portable Runtime (APR): Windows out-of-bounds write in apr_socket_sendv function CVSS 3.1CRITICAL 9.8
- TI-2022-08761 Apache Portable Runtime (APR): out-of-bound writes in the apr_encode family of functions CVSS 3.1CRITICAL 9.8
- TI-2012-00775 tables/apr_hash.c in the Apache Portable Runtime (APR) library through 1.4.5 computes… CVSS 2.0MEDIUM 5.0
- TI-2009-02581 The Solaris pollset feature in the Event Port backend in poll/unix/port.c in the Apache… CVSS 3.1HIGH 7.5
- TI-2011-00350 Stack consumption vulnerability in the fnmatch implementation in apr_fnmatch.c in the… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2021-35940 · CVE Program
- CVE-2021-35940 · NVD
- FIRST EPSS
- GHSA-95qq-4mqm-pp5g · GitHub Advisory Database · CC BY 4.0
- CVE-2021-35940 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences