A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Integer overflow in the readstring function in libsvnrasvn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn:// protocol string, which triggers a heap-based buffer overflow and an out-of-bounds read.
libsvnfsfs/fsfs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service or obtain sensitive information by editing packed revision properties.
On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed.
All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue.
Subversion is not affected on UNIX-like platforms.
Integer overflow in util.c in moddavsvn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service (subversion server crash or memory consumption) and possibly execute arbitrary code via a skel-encoded request body, which triggers an out-of-bounds read and heap-based buffer overflow.
The svnserve server in Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote attackers to cause a denial of service (exit) by aborting a connection.
The moddavsvn server in Subversion 1.8.0 through 1.8.11 allows remote attackers to cause a denial of service (memory consumption) via a large number of REPORT requests, which trigger the traversal of FSFS repository nodes.
AMD. A memory corruption issue was addressed with improved input validation.
Subversion's modauthzsvn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in moddavsvn+modauthzsvn servers 1.14.1 and moddavsvn+modauthzsvn servers 1.10.7
In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.
contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote authenticated users with commit permissions to execute arbitrary commands via shell metacharacters in a filename.
The canonicalizeusername function in svnserve/cyrusauth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.
The reqcheckaccess function in the modauthzsvn module in the httpd server in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4 allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via a crafted header in a (1) MOVE or (2) COPY request, involving an authorization check.
Apache Subversion's moddontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.
In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.
authz.c in the moddavsvn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz shortcircuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.
Subversion before 1.6.23 and 1.7.x before 1.7.10 allows remote authenticated users to cause a denial of service (FSFS repository corruption) via a newline character in a file name.
It was found that Subversion's moddavsvn Apache HTTPD server module will crash in some circumstances when a LOCK request is made against a non-existent URL. This can lead to DoS.
The vulnerability can be triggered by doing a LOCK request against a URL for a path that does not exist in the repository or an invalid activity URL where authentication is not required for the LOCK method.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Philip Martin and Ben Reser as the original reporter of this flaw.
It was found that Subversion's moddavsvn Apache HTTPD server module will crash when a log REPORT request receives a limit that is out of the allowed range. This can lead to a DoS.
Acknowledgements:
Red Hat would like to thank the Apache Subversion for reporting this issue. Upstream acknowledges Greg McMullin, Stefan Fuhrmann, Philip Martin and Ben Reser as the original reporters of this flaw.
A NULL pointer dereference flaw was found in the way moddavsvn module of the subversion concurrent version control system processed requests submitted against the URL of a baselined resource. A remote attacker could use this flaw to cause the httpd child process to crash.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Joe Schaefer of Apache Software Foundation as the original reporter.
The moddavsvn Apache HTTPD server module in Apache Subversion 1.7.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via a request for a URI that triggers a lookup for a virtual transaction name that does not exist.
The moddavsvn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.
The (1) moddavsvn and (2) svnserve servers in Subversion 1.6.0 through 1.7.19 and 1.8.0 through 1.8.11 allow remote attackers to cause a denial of service (assertion failure and abort) via crafted parameter combinations related to dynamically evaluated revision numbers.
modauthzsvn in Apache Subversion 1.7.x before 1.7.21 and 1.8.x before 1.8.14, when using Apache httpd 2.4.x, does not properly restrict anonymous access, which allows remote anonymous users to read hidden files via the path name.
AMD. A memory corruption issue was addressed with improved input validation.
Insufficient validation of filenames against control characters in Apache Subversion repositories served via moddavsvn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository.
All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via moddavsvn. Users are recommended to upgrade to version 1.14.5, which fixes this issue.
Repositories served via other access methods are not affected.
A NULL pointer dereference flaw was found in the way moddavsvn, Apache httpd module for Subversion server, processed requests to lock working copy paths in the repository, when particular Subversion client, requesting the lock, was not previously authenticated to the Subversion server. A remote attacker could use this flaw to cause a denial of service (crash of particular httpd thread, serving the request).
Acknowledgements:
Red Hat would like to thank Hyrum Wright of the Apache Subversion project for reporting this issue. Upstream acknowledges Philip Martin, WANdisco, Inc. as the original reporter.
It was found that Subversion's moddavsvn Apache HTTPD server module will crash when a PROPFIND request is made against activity URLs. This can lead to a DoS.
There is a flaw in moddavsvn that improperly tries to process this request instead of rejecting it and results in an attempt to access invalid memory (NULL). Which results in the httpd process segfaulting and dying. How bad the impact of that is varies based upon the configuration of the httpd server. httpd servers using a prefork MPM will simply start a new process to replace the process that died. Servers using threaded MPMs may be processing other requests in the same process as the process that the attack causes to die. In either case there is an increased processing impact of restarting a process and the cost of per process caches being lost.
An infinite loop was found in the way moddavsvn module of the subversion concurrent version control system processed certain data sets, when SVNPathAuthz configuration directive with value of 'shortcircuit' was used. A remote attacker could use this flaw to cause the httpd child process to consume excessive amount of system memory.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Ivan Zhakov of VisualSVN as the original reporter.
It was found that Subversion's moddavsvn Apache HTTPD server module will crash when a LOCK request is made against activity URLs. This can lead to a DoS.
An activity URL is used by the server to map transactions in the repository to an incoming commit by a client. They are created by using the MKACTIVITY http method on the activity URL the client wishes to create. Activity URLs following the pattern of having /!svn/act/$uuid where $uuid is some unique id the client chooses to use. The denial of service described here issues a LOCK request on an activity URL. There is no meaning to this request in the DAV based HTTP protocols that Subversion uses. There is a flaw in moddavsvn that improperly tries to process this request instead of rejecting it and results in an attempt to access invalid memory (NULL). The invalid memory access causes the httpd child process to segfault.
Acknowledgements:
Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Ben Reser as the original reporter of this flaw.