oss-security - Re: CVE-2022-24963: Apache Portable Runtime (APR): out-of-bound writes in the apr

Message-ID: <Y9lVXsU5SAXDeBes@quantum.stat.colostate.edu>
Date: Tue, 31 Jan 2023 10:52:30 -0700
From: Zube <Zube@...t.colostate.edu>
To: oss-security@...ts.openwall.com
Subject: Re: CVE-2022-24963: Apache Portable Runtime (APR):
 out-of-bound writes in the apr_encode family of functions

> And what's the fix?  Is there a patch to apply or new version to upgrade to?

https://apr.apache.org/download.cgi

has 1.7.1 and 1.6.2, although the directories created are labeled -rc2 and -rc3. 

Cheers.

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.