CVE-2014-3528: Medium severity opensuse vulnerability

Published Aug 19, 2014

Updated

Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.

Affected Software

103 affected components

openSUSE openSUSE=12.3

openSUSE openSUSE=13.1

Apache subversion=1.0.0

Apache subversion=1.0.1

Apache subversion=1.0.2

Apache subversion=1.0.3

Apache subversion=1.0.4

Apache subversion=1.0.5

Apache subversion=1.0.6

Apache subversion=1.0.7

Apache subversion=1.0.8

Apache subversion=1.0.9

Apache subversion=1.1.0

Apache subversion=1.1.1

Apache subversion=1.1.2

Apache subversion=1.1.3

Apache subversion=1.1.4

Apache subversion=1.2.0

Apache subversion=1.2.1

Apache subversion=1.2.2

Apache subversion=1.2.3

Apache subversion=1.3.0

Apache subversion=1.3.1

Apache subversion=1.3.2

Apache subversion=1.4.0

Apache subversion=1.4.1

Apache subversion=1.4.2

Apache subversion=1.4.3

Apache subversion=1.4.4

Apache subversion=1.4.5

Apache subversion=1.4.6

Apache subversion=1.5.0

Apache subversion=1.5.1

Apache subversion=1.5.2

Apache subversion=1.5.3

Apache subversion=1.5.4

Apache subversion=1.5.5

Apache subversion=1.5.6

Apache subversion=1.5.7

Apache subversion=1.5.8

Apache subversion=1.6.0

Apache subversion=1.6.1

Apache subversion=1.6.2

Apache subversion=1.6.3

Apache subversion=1.6.4

Apache subversion=1.6.5

Apache subversion=1.6.6

Apache subversion=1.6.7

Apache subversion=1.6.8

Apache subversion=1.6.9

Apache subversion=1.6.10

Apache subversion=1.6.11

Apache subversion=1.6.12

Apache subversion=1.6.13

Apache subversion=1.6.14

Apache subversion=1.6.15

Apache subversion=1.6.16

Apache subversion=1.6.17

Apache subversion=1.6.18

Apache subversion=1.6.19

Apache subversion=1.6.20

Apache subversion=1.6.21

Apache subversion=1.6.23

Apache subversion=1.7.0

Apache subversion=1.7.1

Apache subversion=1.7.2

Apache subversion=1.7.3

Apache subversion=1.7.4

Apache subversion=1.7.5

Apache subversion=1.7.6

Apache subversion=1.7.7

Apache subversion=1.7.8

Apache subversion=1.7.9

Apache subversion=1.7.10

Apache subversion=1.7.11

Apache subversion=1.7.12

Apache subversion=1.7.13

Apache subversion=1.7.14

Apache subversion=1.7.15

Apache subversion=1.7.16

Apache subversion=1.7.17

Apache subversion=1.8.0

Apache subversion=1.8.1

Apache subversion=1.8.2

Apache subversion=1.8.3

Apache subversion=1.8.4

Apache subversion=1.8.5

Apache subversion=1.8.6

Apache subversion=1.8.7

Apache subversion=1.8.8

Apache subversion=1.8.9

Canonical Ubuntu Linux=12.04

Canonical Ubuntu Linux=14.04

Apple Xcode=6.1.1

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Desktop=7.0

redhat Enterprise Linux Hpc Node=6.0

redhat Enterprise Linux Hpc Node=7.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Server=7.0

redhat Enterprise Linux Server Eus=6.6.z

redhat Enterprise Linux Workstation=6.0

redhat Enterprise Linux Workstation=7.0

Event History

Aug 19, 2014

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-3528?

CVE-2014-3528 is rated as important in severity due to the potential for credential disclosure.

How do I fix CVE-2014-3528?

To fix CVE-2014-3528, upgrade to Apache Subversion version 1.7.17 or later, or 1.8.10 or later.

What versions are affected by CVE-2014-3528?

CVE-2014-3528 affects all versions of Apache Subversion from 1.0.0 to below 1.7.17 and 1.8.x below 1.8.10.

Can CVE-2014-3528 lead to data breaches?

Yes, CVE-2014-3528 could potentially allow remote servers to obtain cached credentials, leading to data breaches.

Is there any workaround for CVE-2014-3528?

There is no official workaround for CVE-2014-3528; upgrading to the patched versions is the only solution.