[CLSA-2026:1786553851] apr-util: Fix of 4 CVEs
Type:
security
Severity:
Critical
Release date:
2026-08-12 16:57:41 UTC
Description:
- CVE-2025-49506: non-constant-time password and hash comparisons in apr_password_validate() leak information through a timing side channel
CVEs fixed:
Updated packages:
  • apr-util-1.6.1-20.el9_2.1.tuxcare.els2.i686.rpm
    sha:cedb74f57d0d946b2a8f824046dad486b54b58da272b1a2155f37a47c1ca0f0e
  • apr-util-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:a25e3e06f8277239fcd1679ab26f5f1c9fcf0cc4c0e385bdc60eac176dfb9775
  • apr-util-bdb-1.6.1-20.el9_2.1.tuxcare.els2.i686.rpm
    sha:0598df995810c18b83fad16be33ebf3209219771969861cadda35f776e471ee9
  • apr-util-bdb-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:325434c8bcd138bf941d3ff9bbd7cda111691481fa161382e30111a72ce97136
  • apr-util-devel-1.6.1-20.el9_2.1.tuxcare.els2.i686.rpm
    sha:32e10bbe8ba1ce2b89e6ef5f4ba2ce5a20252c41a27748829cb65aa25fedbd07
  • apr-util-devel-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:2ecd96dfb91b3d2382dca2ae73abcc6b437342de3f100cb2bd2bb38a16113d14
  • apr-util-ldap-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:c20f4f363e5b86a51a411eff0e59124c904c8a4e57d504132974c244f997acf3
  • apr-util-mysql-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:a4e97210cecfb38845ef34fc8d8a719bbb94bcdfca0e509215825214f2c5f7f0
  • apr-util-odbc-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:527d0e5dbd908c8e5c098bec6a95550385cbfd57381da57b0919d52bcb90f198
  • apr-util-openssl-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:1e8eda554e9074d41c232f6aa85141ffe429187892075dd9cd7055721b72034c
  • apr-util-pgsql-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:beb25d98eefbb0bc233b22bfeac6a4c160edb16387656cf0a5094e1001f56e3e
  • apr-util-sqlite-1.6.1-20.el9_2.1.tuxcare.els2.x86_64.rpm
    sha:8594bb64026defdea6fd151d10ff9631286b3417511aa65e94f2dec888674b3c
Notes:
This page is generated automatically and has not been checked for errors. For clarification or corrections please contact the CloudLinux Packaging Team.