CVE-2025-29868
Private Data Structure Returned From A Public Method vulnerability in Apache Answer.
Does this matter?
Lower severity and a low EPSS score (0.94%). Track it; it rarely justifies an emergency change on its own.
Description
Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.
- CVSS 3.1
- 6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- EPSS
- 0.94% probability · 59th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-495
- Affected
- apache/answer
- Source
- security@apache.org
References
- https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhfMailing List, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2025/04/01/2Mailing List
- http://www.openwall.com/lists/oss-security/2025/04/02/1Mailing List
- http://www.openwall.com/lists/oss-security/2025/04/10/3Mailing List
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.