Cloud Foundry Logo
blog single gear
Security Advisory

USN-5870-1: apr-util vulnerability




Canonical Ubuntu

Versions Affected

  • Canonical Ubuntu 16.04
  • Canonical Ubuntu 18.04
  • Canonical Ubuntu 22.04


Ronald Crane discovered that APR-util did not properly handled memory when encoding or decoding certain input data. An attacker could possibly use this issue to cause a denial of service, or possibly execute arbitrary code. Update Instructions: Run `sudo pro fix USN-5870-1` to fix the vulnerability. The problem can be corrected by updating your system to the following package versions: libaprutil1-dbd-odbc – 1.5.4-1ubuntu0.1~esm2 libaprutil1 – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-mysql – 1.5.4-1ubuntu0.1~esm2 libaprutil1-ldap – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-sqlite3 – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dbd-pgsql – 1.5.4-1ubuntu0.1~esm2 libaprutil1-dev – 1.5.4-1ubuntu0.1~esm2 Available with Ubuntu Pro (Infra-only):

CVEs contained in this USN include: CVE-2022-25147.

Affected Cloud Foundry Products and Versions

Severity is medium unless otherwise noted.

  • cflinuxfs3
    • All versions prior to 0.352.0
  • cflinuxfs4
    • All versions prior to 0.64.0
  • CF Deployment
    • All versions prior to 26.5.0


Users of affected products are strongly encouraged to follow the mitigations below. The Cloud Foundry project recommends upgrading the following releases:

  • cflinuxfs3
    • Upgrade all versions to 0.352.0 or greater
  • cflinuxfs4
    • Upgrade all versions to 0.64.0 or greater
  • CF Deployment
    • Upgrade all versions to 26.5.0 or greater



2023-02-24: Initial vulnerability report published.

Cloud Foundry Foundation Security Team Profile Image

Cloud Foundry Foundation Security Team, AUTHOR