The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade subversion | Aug 30, 2017 | May 5, 2016 |
| Amazon_linux | — | Upgrade subversionUpgrade mod_dav_svn | Jul 1, 2017 | May 5, 2016 |
| Debian | — | Upgrade subversion | Apr 29, 2016 | Apr 29, 2016 |
| Freebsd | — | Upgrade subversionUpgrade subversion18 | Dec 10, 2025 | Apr 28, 2016 |
| Gentoo Linux | — | Upgrade net-libs/serf.Upgrade dev-vcs/subversion. | Oct 30, 2017 | May 5, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade mod_dav_svnUpgrade subversion-libsUpgrade subversion | Dec 4, 2019 | May 5, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade subversionUpgrade subversion-libsUpgrade mod_dav_svn | Dec 18, 2019 | May 5, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade subversion-libsUpgrade subversionUpgrade mod_dav_svn | Dec 11, 2019 | May 5, 2016 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | May 5, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 28, 2016 |
| Suse | — | Upgrade libsvn_auth_kwallet-1-0Upgrade subversion-toolsUpgrade subversion-bash-completionUpgrade subversion-pythonUpgrade subversion-perlUpgrade libsvn_auth_gnome_keyring-1-0Upgrade subversionUpgrade subversion-serverUpgrade subversion-devel | May 6, 2016 | May 5, 2016 |
| Ubuntu | — | Upgrade libsvn1Upgrade subversionUpgrade libapache2-mod-svnUpgrade libapache2-svn | Aug 11, 2017 | May 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub