A NULL pointer dereference flaw was found in the way moddavsvn, Apache httpd module for Subversion server, processed requests to lock working copy paths in the repository, when particular Subversion client, requesting the lock, was not previously authenticated to the Subversion server. A remote attacker could use this flaw to cause a denial of service (crash of particular httpd thread, serving the request).

Acknowledgements:

Red Hat would like to thank Hyrum Wright of the Apache Subversion project for reporting this issue. Upstream acknowledges Philip Martin, WANdisco, Inc. as the original reporter.

A flaw was found in the way moddavsvn handled certain requests when SVNAutoversioning (in "/etc/httpd/conf.d/subversion.conf", for example) was enabled. If an attacker with commit access to a repository sent a request containing a crafted URL, it would cause the httpd process serving the request to crash.

This issue affected Subversion versions 1.7.11 to 1.7.13, and 1.8.1 to 1.8.4. It has been corrected in versions 1.7.14 and 1.8.5.

This issue does not affect the versions of Subversion in Red Hat Enterprise Linux 5 and 6.

Acknowledgements:

Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Philip Martin as the original reporter.