CVE-2015-0251: Medium severity subversion vulnerability

Published Apr 8, 2015

Updated

The moddavsvn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences.

Affected Software

73 affected components

Apache subversion=1.5.0

Apache subversion=1.5.1

Apache subversion=1.5.2

Apache subversion=1.5.3

Apache subversion=1.5.4

Apache subversion=1.5.5

Apache subversion=1.5.6

Apache subversion=1.5.7

Apache subversion=1.5.8

Apache subversion=1.6.0

Apache subversion=1.6.1

Apache subversion=1.6.2

Apache subversion=1.6.3

Apache subversion=1.6.4

Apache subversion=1.6.5

Apache subversion=1.6.6

Apache subversion=1.6.7

Apache subversion=1.6.8

Apache subversion=1.6.9

Apache subversion=1.6.10

Apache subversion=1.6.11

Apache subversion=1.6.12

Apache subversion=1.6.13

Apache subversion=1.6.14

Apache subversion=1.6.15

Apache subversion=1.6.16

Apache subversion=1.6.17

Apache subversion=1.6.18

Apache subversion=1.6.19

Apache subversion=1.6.20

Apache subversion=1.6.21

Apache subversion=1.6.23

Apache subversion=1.7.0

Apache subversion=1.7.1

Apache subversion=1.7.2

Apache subversion=1.7.3

Apache subversion=1.7.4

Apache subversion=1.7.5

Apache subversion=1.7.6

Apache subversion=1.7.7

Apache subversion=1.7.8

Apache subversion=1.7.9

Apache subversion=1.7.10

Apache subversion=1.7.11

Apache subversion=1.7.12

Apache subversion=1.7.13

Apache subversion=1.7.14

Apache subversion=1.7.15

Apache subversion=1.7.16

Apache subversion=1.7.17

Apache subversion=1.7.18

Apache subversion=1.7.19

Apache subversion=1.8.0

Apache subversion=1.8.1

Apache subversion=1.8.2

Apache subversion=1.8.3

Apache subversion=1.8.4

Apache subversion=1.8.5

Apache subversion=1.8.6

Apache subversion=1.8.7

Apache subversion=1.8.8

Apache subversion=1.8.9

Apache subversion=1.8.10

Apache subversion=1.8.11

openSUSE openSUSE=13.1

openSUSE openSUSE=13.2

redhat Enterprise Linux Desktop=6.0

redhat Enterprise Linux Hpc Node=6.0

redhat Enterprise Linux Server=6.0

redhat Enterprise Linux Server Eus=6.7.z

redhat Enterprise Linux Workstation=6.0

Oracle Solaris=11.3

Apple Xcode=7.0

Event History

Apr 8, 2015

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2015-0251?

CVE-2015-0251 has a medium severity rating due to its ability to allow remote authenticated users to spoof the svn:author property.

How do I fix CVE-2015-0251?

To fix CVE-2015-0251, upgrade to Subversion version 1.8.12 or later, or apply patches as recommended by your vendor.

What versions of Subversion are affected by CVE-2015-0251?

CVE-2015-0251 affects Subversion versions 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11.

Can CVE-2015-0251 lead to unauthorized changes?

Yes, CVE-2015-0251 can lead to unauthorized changes by allowing attackers to spoof the author of commits.

Who is at risk of CVE-2015-0251?

Remote authenticated users of Subversion who are using affected versions are at risk of the CVE-2015-0251 vulnerability.