REDHAT-BUG-709112: Medium severity subversion vulnerability

Published May 30, 2011

Updated

An infinite loop was found in the way moddavsvn module of the subversion concurrent version control system processed certain data sets, when SVNPathAuthz configuration directive with value of 'shortcircuit' was used. A remote attacker could use this flaw to cause the httpd child process to consume excessive amount of system memory.

Acknowledgements:

Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Ivan Zhakov of VisualSVN as the original reporter.

Affected Software

1 affected component

Apache subversion

Event History

May 30, 2011

Data Sourced

via Red Hat·04:56 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-709112?

The severity of REDHAT-BUG-709112 is considered high due to the potential for a remote attacker to exploit an infinite loop.

How do I fix REDHAT-BUG-709112?

To fix REDHAT-BUG-709112, ensure that you update your Subversion to the latest version where this vulnerability is patched.

What versions of Subversion are affected by REDHAT-BUG-709112?

REDHAT-BUG-709112 affects certain versions of the Apache Subversion when the SVNPathAuthz directive is configured with 'short_circuit'.

Can REDHAT-BUG-709112 lead to service outages?

Yes, REDHAT-BUG-709112 can lead to service outages due to excessive resource consumption in the httpd child process.

What is the cause of the vulnerability in REDHAT-BUG-709112?

The cause of the vulnerability in REDHAT-BUG-709112 is an infinite loop encountered in the mod_dav_svn module when processing specific data sets.