PT-2025-14083 · Apache · Apache Answer

Hamed Kohi + 1 · Published 2025-04-01 · Updated 2025-04-05 · CVE-2025-29868

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Apache Answer versions through 1.4.2 Apache Answer versions prior to 1.4.5

Description This issue affects users who use externally referenced images. When a user accesses such an image, the provider of the image may obtain private information about the IP address of the accessing user.

Recommendations For Apache Answer versions through 1.4.2, upgrade to version 1.4.5, which fixes the issue and allows administrators to set whether external content can be displayed. For Apache Answer versions prior to 1.4.5, upgrade to version 1.4.5 to resolve the issue.

Fix

Weakness Enumeration

CWE-495

Related Identifiers

BDU:2025-07572

CVE-2025-29868

GHSA-WQCC-MFHW-53PC

GO-2025-3587

OPENSUSE-SU-2025:14970-1

Affected Products

Apache Answer

References · 26

• https://osv.dev/vulnerability/openSUSE-SU-2025:14970-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-29868 · Vendor Advisory
• https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3587 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-wqcc-mfhw-53pc · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-29868 · Security Note
• https://bdu.fstec.ru/vul/2025-07572 · Security Note
• https://github.com/apache/answer · Note
• https://github.com/apache/answer/issues/1250 · Note
• https://suse.com/security/cve/CVE-2025-29072 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/ZBHJANMC5TN4MHLVGPYKJGT774IKFUQ3 · Note
• https://suse.com/security/cve/CVE-2025-31135 · Note
• https://t.me/cvenotify/117168 · Telegram Post
• https://suse.com/security/cve/CVE-2025-30223 · Note
• https://suse.com/security/cve/CVE-2025-29868 · Note