-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sun, 16 Aug 2026 18:28:54 +0200 Source: apr-util Architecture: source Version: 1.6.3-1+deb12u1 Distribution: bookworm-security Urgency: high Maintainer: Debian Apache Maintainers <debian-apache@lists.debian.org> Changed-By: Bastien Roucariès <rouca@debian.org> Closes: 1143837 Changes: apr-util (1.6.3-1+deb12u1) bookworm-security; urgency=high . * Team upload upload by the apache team (Closes: #1143837) * Fix CVE-2025-49506: Function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack. * Fix CVE-2026-32327: A stack recursion attack against any library consumer which parses XML from untrusted sources and uses the apr_xml_quote_elem() function * Fix CVE-2026-34191: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection) vulnerability in Apache Portable Runtime Utility via apr_dbd_oracle provider. * Fix CVE-2026-34501: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility redis client. * Fix CVE-2026-34502: Heap-based Buffer Overflow vulnerability in Apache Portable Runtime Utility memcached client Checksums-Sha1: 2d052831b44b896d26e3cbf2a02b347820a40401 2792 apr-util_1.6.3-1+deb12u1.dsc 8c6293a787b69986ce43bc49c7c247d4ff5fc828 432692 apr-util_1.6.3.orig.tar.bz2 2dc47748963f988922fc96e60612a15d42769c48 833 apr-util_1.6.3.orig.tar.bz2.asc db0cd204805b9841cbb398dba649ce5ede2f6a1b 347680 apr-util_1.6.3-1+deb12u1.debian.tar.xz 7a094c4f325f27c52403c1c7a2b7238376726470 5888 apr-util_1.6.3-1+deb12u1_source.buildinfo Checksums-Sha256: 80ddd39ee305158055729b83c53e7030b63508cdb8fdfe5b0f4ebab947077866 2792 apr-util_1.6.3-1+deb12u1.dsc a41076e3710746326c3945042994ad9a4fcac0ce0277dd8fea076fec3c9772b5 432692 apr-util_1.6.3.orig.tar.bz2 5fd08491a2cb35fdbf9fa93d753cfd25e59fe58a75a3f3ed62582ebf2a5b3a51 833 apr-util_1.6.3.orig.tar.bz2.asc f52fa29f517c3a746ec1227f868ac62fe37f99a0c1246291a78a541fdf9461e5 347680 apr-util_1.6.3-1+deb12u1.debian.tar.xz a15f1127ee1519ceb751df5020423cf83603848f49443df3e26d41f13c664e04 5888 apr-util_1.6.3-1+deb12u1_source.buildinfo Files: b53df54ab4c8f76670c97cb452ce7acb 2792 libs optional apr-util_1.6.3-1+deb12u1.dsc b6e8c9b31d938fe5797ceb0d1ff2eb69 432692 libs optional apr-util_1.6.3.orig.tar.bz2 46ec16add63af5f15630818c96ce2f1f 833 libs optional apr-util_1.6.3.orig.tar.bz2.asc 339744d138b807b272069e0797367ebd 347680 libs optional apr-util_1.6.3-1+deb12u1.debian.tar.xz 99a7c54621e6e0908b3b9c2d53643b73 5888 libs optional apr-util_1.6.3-1+deb12u1_source.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEEXQGHuUCiRbrXsPVqADoaLapBCF8FAmqB8EUACgkQADoaLapB CF+5LQ//VFllGVem8LGgxFjfmfewk1Mqcn4oIFdt+5sV3k+XQFFGE7phYddVF6C2 0vNkPyip8ExAj9OR7BM7i/S2bUpC2vptuZ1Y3G3Hd9h8LNYiubyF2z3dwOAXhXsw o+x8p4MSFciGdmrhO4NKNEUnG4+rjzk4U2gd9kc990xI1jMyW93sa3yfdIsKtSLP hX+wubB1Y6+ARUpLRysTGn13muDvlYAEVCE33g+O0BwWFMDrMJkROocnLSo/I4IH Zos3whOiHyoQLyB3XlIciUk6jBf8kF1SZ8VndUQczlfLFNYl923hYKykr52s58fJ MjPJFlMO3bP/ET0xU0b12TqXfn+CiVqUoSn9Qandn0rXhs/gJH24delCeHUha7Dk Vr96vmL8JYv+14jCgKwkSopbozxg4/rrVSt90pG5NoWMQLyvOKAs39AvwgA5Y6BH nPwvDQuLVST6eCBjQKJOQeGFGLnDrjwXc6iWkO6jk4crWlBkVyYFEgnjVc3qY4I4 ixY0pRpJFgFuRlqCIsBjMcJV3cWYJZrvYzNE02PfIt84RxZouYrsn/ggvPZRiKuG vhf6q+De3vJIu0HvHSxk2GunjCixKSVWNpvCwJvBPoqTCVW2gbHcLEdrrhCp2fGE +QExsAz7Nn5tRq5jxjPbYapH48ubFqY2E/m0h8gi/kzcBe4eavI= =ywiX -----END PGP SIGNATURE-----
