Medium [CVE-2025-49506] Information disclosure via timing attack in password validation

APR-util versions 1.6.3 (and earlier) function apr_password_validate() was not constant-time with regards to hashes or passwords comparisons, potentially leaking their content via a side channel timing attack particularly on platforms without crypt() such as Windows, BeOS, NetWare, or Android.

Users are recommended to upgrade to version 1.6.4, which fixes this issue. A flaw was found in Apache Portable Runtime Utility (apr-util).

By observing the time differences in comparisons, an attacker could potentially deduce the content of sensitive information like password hashes. This vulnerability is assessed as Low Impact due to significant practical exploitation barriers.

While the theoretical outcome of a successful timing attack is hash disclosure (Confidentiality: High), isolating microsecond-level comparison differences over a network is rendered practically infeasible by unpredictable network latency, packet jitter, and server scheduling noise (Attack Complexity: High).

Additionally, RHEL environments natively rely on the system crypt() implementation for standard password checks, bypassing the vulnerable non-constant-time fallback code path in standard deployment scenarios. Red Hat severity: Low — CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

Weakness: CWE-208.