CVE-2025-29868: Apache Answer: Using externally referenced images can leak user privacy.
First published: Tue Apr 01 2025(Updated: )
Private Data Structure Returned From A Public Method vulnerability in Apache Answer. This issue affects Apache Answer: through 1.4.2. If a user uses an externally referenced image, when a user accesses this image, the provider of the image may obtain private information about the ip address of that accessing user. Users are recommended to upgrade to version 1.4.5, which fixes the issue. In the new version, administrators can set whether external content can be displayed.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Answer | <1.4.2 | |
| go/github.com/apache/answer | <1.4.5 | 1.4.5 |
| Apache Answer | <=1.4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2025-29868
- https://lists.apache.org/thread/l7pohw5g03g3qsvrz8pqc9t29mdv5lhf
- https://github.com/apache/answer/issues/1250
- http://www.openwall.com/lists/oss-security/2025/04/01/2
- http://www.openwall.com/lists/oss-security/2025/04/02/1
- https://github.com/advisories/GHSA-wqcc-mfhw-53pc (Advisory)
- http://www.openwall.com/lists/oss-security/2025/04/10/3
Frequently Asked Questions
What is the severity of CVE-2025-29868?
CVE-2025-29868 is classified as a medium severity vulnerability.
How do I fix CVE-2025-29868?
To fix CVE-2025-29868, upgrade Apache Answer to version 1.4.3 or later.
What type of vulnerability is CVE-2025-29868?
CVE-2025-29868 is a private data structure exposure vulnerability.
Which versions of Apache Answer are affected by CVE-2025-29868?
CVE-2025-29868 affects Apache Answer versions up to 1.4.2.
What could be the impact of CVE-2025-29868?
The impact of CVE-2025-29868 could allow external providers to access private user data.
- collector/oss-sec
- source/oss-sec
- alias/CVE-2025-29868
- agent/first-publish-date
- agent/weakness
- agent/title
- agent/type
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- agent/author
- agent/trending
- agent/source
- collector/epss-latest
- source/FIRST
- agent/epss
- agent/severity
- collector/mitre-cve
- source/MITRE
- agent/references
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-wqcc-mfhw-53pc
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- agent/event
- collector/github-advisory
- vendor/apache
- canonical/apache answer
- package-manager/go
- version/apache answer/1.4.2