CyberRota Analysis
AI-GeneratedThe vulnerability affects APR-util versions 1.6.3 and earlier, specifically in the apr_password_validate() function, which is susceptible to side-channel timing attacks that could expose hash and password content. This issue is particularly critical for users on platforms lacking the crypt() function, such as Windows and Android. Organizations utilizing these affected versions should prioritize upgrading to version 1.6.4 to mitigate the risk of sensitive data leakage.
Original NVD Description
APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android. Users are recommended to upgrade to version 1.6.4, which fixes this issue.
Related CVEs
Other vulnerabilities affecting the same vendor(s)