PT-2021-21068 · Apache+2 · Apache Portable Runtime+2

Published 2021-08-23 · Updated 2025-12-10 · CVE-2021-35940

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions: Apache Portable Runtime versions 1.7.0 Apache Portable Runtime versions prior to 1.6.3

Description: The issue is related to an out-of-bounds array read in the apr time exp*() functions. This problem was previously fixed in the Apache Portable Runtime 1.6.3 release, but the fix was not applied to the APR 1.7.x branch, causing version 1.7.0 to be vulnerable.

Recommendations: For Apache Portable Runtime version 1.7.0, consider updating to a version that includes the fix for the out-of-bounds array read issue. For Apache Portable Runtime versions prior to 1.6.3, update to version 1.6.3 or later to resolve the issue.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

ALT-PU-2024-15150

ALT-PU-2025-15436

BIT-APR-2021-35940

CVE-2021-35940

MGASA-2021-0428

OPENSUSE-SU-2024:11865-1

USN-5056-1

Affected Products

Alt Linux

Apache Portable Runtime

Ubuntu

References · 42

• https://nvd.nist.gov/vuln/detail/CVE-2021-35940 · Security Note
• https://ubuntu.com/security/notices/USN-5056-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11865-1 · Vendor Advisory
• https://lists.apache.org/thread.html/ra2868b53339a6af65577146ad87016368c138388b09bff9d2860f50e%40%3Cdev.apr.apache.org%3E · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-35940 · Vendor Advisory
• https://oracle.com/security-alerts/cpujul2022.html · Patch
• https://osv.dev/vulnerability/BIT-apr-2021-35940 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-35940 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-35940 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0428 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0428.html · Security Note
• http://svn.apache.org/viewvc?view=revision&revision=1891198 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-35940 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-35940 · Vendor Advisory
• https://dist.apache.org/repos/dist/release/apr/patches/apr-1.7.0-CVE-2021-35940.patch · Vendor Advisory