CVE-2016-8734: Medium severity subversion vulnerability

Published Oct 16, 2017

Updated

Apache Subversion's moddontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.

Affected Software

84 affected components

Apache subversion=1.4.0

Apache subversion=1.4.1

Apache subversion=1.4.2

Apache subversion=1.4.3

Apache subversion=1.4.4

Apache subversion=1.4.5

Apache subversion=1.4.6

Apache subversion=1.5.0

Apache subversion=1.5.1

Apache subversion=1.5.2

Apache subversion=1.5.3

Apache subversion=1.5.4

Apache subversion=1.5.5

Apache subversion=1.5.6

Apache subversion=1.5.7

Apache subversion=1.5.8

Apache subversion=1.6.0

Apache subversion=1.6.1

Apache subversion=1.6.2

Apache subversion=1.6.3

Apache subversion=1.6.4

Apache subversion=1.6.5

Apache subversion=1.6.6

Apache subversion=1.6.7

Apache subversion=1.6.8

Apache subversion=1.6.9

Apache subversion=1.6.10

Apache subversion=1.6.11

Apache subversion=1.6.12

Apache subversion=1.6.13

Apache subversion=1.6.14

Apache subversion=1.6.15

Apache subversion=1.6.16

Apache subversion=1.6.17

Apache subversion=1.6.18

Apache subversion=1.6.19

Apache subversion=1.6.20

Apache subversion=1.6.21

Apache subversion=1.6.23

Apache subversion=1.7.0

Apache subversion=1.7.1

Apache subversion=1.7.2

Apache subversion=1.7.3

Apache subversion=1.7.4

Apache subversion=1.7.5

Apache subversion=1.7.6

Apache subversion=1.7.7

Apache subversion=1.7.8

Apache subversion=1.7.9

Apache subversion=1.7.10

Apache subversion=1.7.11

Apache subversion=1.7.12

Apache subversion=1.7.13

Apache subversion=1.7.14

Apache subversion=1.7.15

Apache subversion=1.7.16

Apache subversion=1.7.17

Apache subversion=1.7.18

Apache subversion=1.7.19

Apache subversion=1.7.20

Apache subversion=1.8.0

Apache subversion=1.8.1

Apache subversion=1.8.2

Apache subversion=1.8.3

Apache subversion=1.8.4

Apache subversion=1.8.5

Apache subversion=1.8.6

Apache subversion=1.8.7

Apache subversion=1.8.8

Apache subversion=1.8.9

Apache subversion=1.8.10

Apache subversion=1.8.11

Apache subversion=1.8.12

Apache subversion=1.8.13

Apache subversion=1.8.14

Apache subversion=1.8.15

Apache subversion=1.8.16

Apache subversion=1.9.0

Apache subversion=1.9.1

Apache subversion=1.9.2

Apache subversion=1.9.3

Apache subversion=1.9.4

Debian Debian Linux=8.0

Debian Debian Linux=9.0

Event History

Oct 16, 2017

CVE Published

via MITRE·01:00 PM

Data Sourced

via MITRE·01:00 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2016-8734?

CVE-2016-8734 has been classified as a denial-of-service vulnerability that can lead to significant resource exhaustion.

How do I fix CVE-2016-8734?

To mitigate CVE-2016-8734, users should upgrade to a patched version of Apache Subversion that addresses this vulnerability.

Which versions are affected by CVE-2016-8734?

CVE-2016-8734 affects Apache Subversion versions 1.4.0 through 1.8.16 and 1.9.0 through 1.9.4.

What types of attacks are enabled by CVE-2016-8734?

CVE-2016-8734 allows attackers to perform denial-of-service attacks through exponential XML entity expansion.

Is there a workaround for CVE-2016-8734?

While the best solution is to update to a secure version, users may limit exposure by monitoring and blocking malicious XML requests.