AZL-94628
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-94628.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/AZL-94628
- Upstream
- Published
- 2026-08-06T15:16:41Z
- Modified
- 2026-09-16T06:39:01Z
- Summary
- CVE-2025-49506 affecting package apr-util for versions less than 1.6.3-3
- Details
-
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android.
Users are recommended to upgrade to version 1.6.4, which fixes this issue.
- References