CVE-2017-9800: Input Validation
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Other sources
A Subversion client sometimes connects to URLs provided by the repository. This happens in two primary cases: during 'checkout', 'export', 'update', and 'switch', when the tree being downloaded contains svn:externals properties; and when using 'svnsync sync' with one URL argument.
A maliciously constructed svn+ssh:// URL would cause Subversion clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server.
The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-9800?
CVE-2017-9800 has a high severity rating due to the potential for arbitrary code execution.
How do I fix CVE-2017-9800?
To fix CVE-2017-9800, upgrade Subversion to versions 1.8.19, 1.9.7, or 1.10.0 and later.
Which versions of Subversion are affected by CVE-2017-9800?
Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 are affected by CVE-2017-9800.
What does CVE-2017-9800 exploit?
CVE-2017-9800 exploits a maliciously constructed svn+ssh:// URL to execute arbitrary shell commands.
What should I do if I cannot upgrade due to compatibility issues with CVE-2017-9800?
If you cannot upgrade, consider implementing network access controls to limit exposure to untrusted SVN repositories.