CVE-2011-1783: Medium severity subversion vulnerability
An infinite loop was found in the way moddavsvn module of the subversion concurrent version control system processed certain data sets, when SVNPathAuthz configuration directive with value of 'shortcircuit' was used. A remote attacker could use this flaw to cause the httpd child process to consume excessive amount of system memory.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Ivan Zhakov of VisualSVN as the original reporter.
Other sources
The moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x and 1.6.x before 1.6.17, when the SVNPathAuthz shortcircuit option is enabled, allows remote attackers to cause a denial of service (infinite loop and memory consumption) in opportunistic circumstances by requesting data.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-1783?
CVE-2011-1783 has a medium severity rating due to the potential for a denial of service attack.
How do I fix CVE-2011-1783?
To fix CVE-2011-1783, update to the latest version of Apache Subversion that addresses this vulnerability.
What versions are affected by CVE-2011-1783?
CVE-2011-1783 affects Apache Subversion versions between 1.5.0 and 1.6.17.
Can CVE-2011-1783 be exploited remotely?
Yes, CVE-2011-1783 can be exploited remotely by an attacker to cause an infinite loop.
What components are involved in CVE-2011-1783?
CVE-2011-1783 involves the mod_dav_svn module of the Apache Subversion system.