The get_resource function in repos.c in the mod_dav_svn module in Apache Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is enabled, allows remote attackers to cause a denial of service (crash) via vectors related to the server root and request methods other than GET, as demonstrated by the "svn ls http://svn.example.com" command.
CVSS Details
- CVSS 3.1 Base Score: 3.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade subversion | Aug 30, 2017 | Feb 14, 2014 |
| Centos_linux | — | Upgrade subversion-kdeUpgrade subversion-javahlUpgrade subversion-gnomeUpgrade subversion-svn2clUpgrade mod_dav_svnUpgrade subversion-perlUpgrade subversion-rubyUpgrade subversionUpgrade subversion-devel | Dec 1, 2016 | Feb 14, 2014 |
| Debian | — | Upgrade subversion | Jul 30, 2024 | Feb 14, 2014 |
| Gentoo Linux | — | Upgrade dev-vcs/subversion.Upgrade net-libs/serf. | Oct 30, 2017 | Feb 14, 2014 |
| Oracle Solaris | — | Upgrade entire to version 0.5.11-0.175.3.0.0.30.0 on Solaris 11.3 | May 29, 2017 | Feb 14, 2014 |
| Oracle_linux | — | Upgrade subversion-perlUpgrade subversion-develUpgrade subversion-gnomeUpgrade subversionUpgrade mod_dav_svnUpgrade subversion-kdeUpgrade subversion-javahlUpgrade subversion-rubyUpgrade subversion-svn2cl | Oct 16, 2024 | Feb 14, 2014 |
| Suse | — | Upgrade libsvn_auth_gnome_keyring-1-0Upgrade subversionUpgrade subversion-serverUpgrade subversion-perlUpgrade subversion-bash-completionUpgrade subversion-toolsUpgrade subversion-develUpgrade libsvn_auth_kwallet-1-0Upgrade subversion-python | Dec 18, 2015 | Feb 14, 2014 |
| Ubuntu | — | Upgrade libsvn1Upgrade libapache2-svnUpgrade subversion | Nov 8, 2024 | Feb 14, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub