PT-2023-1354 · Apache · Apache Portable Runtime

Ronald Crane · Published 2023-01-31 · Updated 2025-12-10 · CVE-2022-28331

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime versions 1.7.0 and earlier

Description The issue is related to a buffer overflow in the apr socket sendv() function of the Apache Portable Runtime (APR) library on Windows operating systems. This is caused by an integer overflow, allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Apache Portable Runtime versions 1.7.0 and earlier, consider updating to a version later than 1.7.0 to resolve the issue. As a temporary workaround, consider restricting the use of the apr socket sendv() function until a patch is available.

Fix

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

ALT-PU-2025-15436

BDU:2023-00668

BIT-APR-2022-28331

CVE-2022-28331

Affected Products

Apache Portable Runtime

References · 18

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-49582 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28331 · Security Note
• https://bdu.fstec.ru/vul/2023-00668 · Security Note
• https://osv.dev/vulnerability/BIT-apr-2022-28331 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/690551 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-28331 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24963 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2022-28331 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28331 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35940 · Security Note
• https://lists.apache.org/thread/5pfdfn7h0vsdo5xzjn97vghp0x42jj2r · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2025-15436 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-28331 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-00850 · Security Note
• https://bdu.fstec.ru/vul/2025-07709 · Security Note