The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.
CVSS Details
- CVSS 3.1 Base Score: 6.8
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade subversion | Aug 30, 2017 | May 5, 2016 |
| Amazon_linux | — | Upgrade subversionUpgrade mod_dav_svn | Jul 1, 2017 | May 5, 2016 |
| Debian | — | Upgrade subversion | Apr 29, 2016 | Apr 29, 2016 |
| Freebsd | — | Upgrade subversionUpgrade subversion18 | Dec 10, 2025 | Apr 28, 2016 |
| Gentoo Linux | — | Upgrade dev-vcs/subversion.Upgrade net-libs/serf. | Oct 30, 2017 | May 5, 2016 |
| Huawei Euleros 2_0_sp2 | — | Upgrade subversion-libsUpgrade subversionUpgrade mod_dav_svn | Dec 4, 2019 | May 5, 2016 |
| Huawei Euleros 2_0_sp3 | — | Upgrade mod_dav_svnUpgrade subversion-libsUpgrade subversion | Dec 18, 2019 | May 5, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade subversion-libsUpgrade subversionUpgrade mod_dav_svn | Dec 11, 2019 | May 5, 2016 |
| Oracle Solaris | — | Upgrade entire/ to version 11.4-11.4.0.0.1.15.0 on Solaris 11.4 | Oct 19, 2018 | May 5, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 28, 2016 |
| Suse | — | Upgrade subversion-serverUpgrade subversionUpgrade subversion-develUpgrade subversion-perlUpgrade libsvn_auth_kwallet-1-0Upgrade libsvn_auth_gnome_keyring-1-0Upgrade subversion-bash-completionUpgrade subversion-pythonUpgrade subversion-tools | May 6, 2016 | May 5, 2016 |
| Ubuntu | — | Upgrade libsvn1Upgrade libapache2-svnUpgrade libapache2-mod-svnUpgrade subversion | Aug 11, 2017 | May 5, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub