Improper Input Validation Affecting subversion package, versions <1.7.14-1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-DEBIAN9-SUBVERSION-344507
- published 7 Dec 2013
- disclosed 7 Dec 2013
How to fix?
Upgrade Debian:9
subversion
to version 1.7.14-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream subversion
package and not the subversion
package as distributed by Debian
.
See How to fix?
for Debian:9
relevant fixed versions and status.
The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.
References
- https://security-tracker.debian.org/tracker/CVE-2013-4558
- http://osvdb.org/100363
- http://subversion.apache.org/security/CVE-2013-4558-advisory.txt
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html
- http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1033431
- https://github.com/apache/subversion/commit/2c77c43e4255555f3b79f761f0d141393a3856cc
- https://github.com/apache/subversion/commit/647e3f8365a74831bb915f63793b63e31fae062d