CVE-2014-3522: Medium severity subversion vulnerability

Published Aug 19, 2014

Updated

The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.

Affected Software

72 affected components

Apache subversion=1.4.0

Apache subversion=1.4.1

Apache subversion=1.4.2

Apache subversion=1.4.3

Apache subversion=1.4.4

Apache subversion=1.4.5

Apache subversion=1.4.6

Apache subversion=1.5.0

Apache subversion=1.5.1

Apache subversion=1.5.2

Apache subversion=1.5.3

Apache subversion=1.5.4

Apache subversion=1.5.5

Apache subversion=1.5.6

Apache subversion=1.5.7

Apache subversion=1.5.8

Apache subversion=1.6.0

Apache subversion=1.6.1

Apache subversion=1.6.2

Apache subversion=1.6.3

Apache subversion=1.6.4

Apache subversion=1.6.5

Apache subversion=1.6.6

Apache subversion=1.6.7

Apache subversion=1.6.8

Apache subversion=1.6.9

Apache subversion=1.6.10

Apache subversion=1.6.11

Apache subversion=1.6.12

Apache subversion=1.6.13

Apache subversion=1.6.14

Apache subversion=1.6.15

Apache subversion=1.6.16

Apache subversion=1.6.17

Apache subversion=1.6.18

Apache subversion=1.6.19

Apache subversion=1.6.20

Apache subversion=1.6.21

Apache subversion=1.6.23

Apache subversion=1.7.0

Apache subversion=1.7.1

Apache subversion=1.7.2

Apache subversion=1.7.3

Apache subversion=1.7.4

Apache subversion=1.7.5

Apache subversion=1.7.6

Apache subversion=1.7.7

Apache subversion=1.7.8

Apache subversion=1.7.9

Apache subversion=1.7.10

Apache subversion=1.7.11

Apache subversion=1.7.12

Apache subversion=1.7.13

Apache subversion=1.7.14

Apache subversion=1.7.15

Apache subversion=1.7.16

Apache subversion=1.7.17

Apache subversion=1.8.0

Apache subversion=1.8.1

Apache subversion=1.8.2

Apache subversion=1.8.3

Apache subversion=1.8.4

Apache subversion=1.8.5

Apache subversion=1.8.6

Apache subversion=1.8.7

Apache subversion=1.8.8

Apache subversion=1.8.9

openSUSE openSUSE=12.3

openSUSE openSUSE=13.1

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Apple Xcode=6.1.1

Remediation

Patch Available

https://subversion.apache.org/security/CVE-2014-3522-advisory.txt

Event History

Aug 19, 2014

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3522?

CVE-2014-3522 has a medium severity rating due to the potential for man-in-the-middle attacks.

How do I fix CVE-2014-3522?

To fix CVE-2014-3522, upgrade to Apache Subversion version 1.7.18 or later, or 1.8.10 or later.

What types of attacks can CVE-2014-3522 facilitate?

CVE-2014-3522 can facilitate man-in-the-middle attacks that allow attackers to spoof servers via crafted certificates.

Which versions of Apache Subversion are affected by CVE-2014-3522?

CVE-2014-3522 affects Apache Subversion versions 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10.

Is any specific configuration needed to exploit CVE-2014-3522?

Exploitation of CVE-2014-3522 does not require any specific configuration, merely a crafted X.509 certificate.