CVE-2019-0203: Null Pointer Dereference
First published: Thu Sep 26 2019(Updated: )
In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.
Credit: security@apache.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Apache Subversion | <=1.9.10 | |
| Apache Subversion | >=1.10.0<=1.10.4 | |
| Apache Subversion | >=1.11.0<=1.11.1 | |
| Apache Subversion | =1.12.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is CVE-2019-0203?
CVE-2019-0203 is a vulnerability in Apache Subversion that can cause the svnserve server process to exit when certain sequences of protocol commands are sent by a client.
Which versions of Apache Subversion are affected by CVE-2019-0203?
Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0 are affected by CVE-2019-0203.
What is the severity of CVE-2019-0203?
CVE-2019-0203 has a severity score of 7.5 (high).
How can CVE-2019-0203 be exploited?
CVE-2019-0203 can be exploited by sending certain sequences of protocol commands to the svnserve server process.
Is there a fix available for CVE-2019-0203?
Yes, the fix for CVE-2019-0203 is to upgrade Apache Subversion to version 1.9.11, 1.10.6, or 1.12.2.
- collector/nvd-index
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/references
- agent/remedy
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/author
- agent/event
- agent/type
- agent/description
- agent/first-publish-date
- vendor/apache
- canonical/apache subversion
- version/apache subversion/1.9.10
- version/apache subversion/1.10.0
- version/apache subversion/1.10.4
- version/apache subversion/1.11.0
- version/apache subversion/1.11.1
- version/apache subversion/1.12.0