PT-2023-1354 · Apache+1 · Apache Portable Runtime+1

Ronald Crane · CVE-2022-28331 · Published 2023-01-31 · Updated 2025-12-10

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Apache Portable Runtime versions 1.7.0 and earlier

Description The issue is related to a buffer overflow in the apr socket sendv() function of the Apache Portable Runtime (APR) library on Windows operating systems. This is caused by an integer overflow, allowing a remote attacker to impact the confidentiality, integrity, and availability of protected information.

Recommendations For Apache Portable Runtime versions 1.7.0 and earlier, consider updating to a version later than 1.7.0 to resolve the issue. As a temporary workaround, consider restricting the use of the apr socket sendv() function until a patch is available.

Exploit

Fix

Memory Corruption

Integer Overflow

Weakness Enumeration

CWE-787

CWE-190

Related Identifiers

ALT-PU-2025-15436

BDU:2023-00668

BIT-APR-2022-28331

CVE-2022-28331

Affected Products

Alt Linux

Apache Portable Runtime

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28331.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-28331 · Vendor Advisory
• https://lists.apache.org/thread/5pfdfn7h0vsdo5xzjn97vghp0x42jj2r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28331 · Security Note
• https://osv.dev/vulnerability/ALPINE-CVE-2022-28331 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-apr-2022-28331 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-28331 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-00668 · Security Note
• https://security.alpinelinux.org/vuln/CVE-2022-28331 · Note
• https://t.me/cvenotify/43196 · Telegram Post