Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.
CVSS Details
- CVSS 3.1 Base Score: 4.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | alpine-linux-upgrade-subversion | Mar 26, 2024 | Apr 12, 2022 | |
| Amazon_linux_2023 | amazon-linux-2023-upgrade-python3-subversionamazon-linux-2023-upgrade-python3-subversion-debuginfoamazon-linux-2023-upgrade-subversionamazon-linux-2023-upgrade-subversion-debuginfoamazon-linux-2023-upgrade-subversion-debugsourceamazon-linux-2023-upgrade-subversion-develamazon-linux-2023-upgrade-subversion-devel-debuginfoamazon-linux-2023-upgrade-subversion-javahlamazon-linux-2023-upgrade-subversion-libsamazon-linux-2023-upgrade-subversion-libs-debuginfoamazon-linux-2023-upgrade-subversion-perlamazon-linux-2023-upgrade-subversion-perl-debuginfoamazon-linux-2023-upgrade-subversion-toolsamazon-linux-2023-upgrade-subversion-tools-debuginfo | Feb 17, 2025 | Mar 27, 2022 | |
| Apple Osx Subversion | apple-osx-upgrade-latest | Jul 27, 2022 | Apr 12, 2022 | |
| Arch Linux | arch-linux-upgrade-latest | Jul 11, 2025 | Apr 12, 2022 | |
| Debian | debian-upgrade-subversion | Apr 14, 2022 | Apr 12, 2022 | |
| Freebsd | freebsd-upgrade-package-subversionfreebsd-upgrade-package-mod_dav_svnfreebsd-upgrade-package-subversion-ltsfreebsd-upgrade-package-mod_dav_svn-lts | Nov 4, 2022 | Apr 13, 2022 | |
| Huawei Euleros 2_0_sp10 | huawei-euleros-2_0_sp10-upgrade-subversionhuawei-euleros-2_0_sp10-upgrade-subversion-help | Aug 2, 2022 | Apr 12, 2022 | |
| Huawei Euleros 2_0_sp8 | huawei-euleros-2_0_sp8-upgrade-mod_dav_svnhuawei-euleros-2_0_sp8-upgrade-subversionhuawei-euleros-2_0_sp8-upgrade-subversion-libs | Jun 22, 2022 | Apr 12, 2022 | |
| Huawei Euleros 2_0_sp9 | huawei-euleros-2_0_sp9-upgrade-subversionhuawei-euleros-2_0_sp9-upgrade-subversion-help | Jul 11, 2022 | Apr 12, 2022 | |
| Redhat_linux | — | no-fix-redhat-rpm-package | Jul 9, 2025 | Apr 12, 2022 |
| Suse | — | suse-upgrade-libsvn_auth_gnome_keyring-1-0suse-upgrade-libsvn_auth_kwallet-1-0suse-upgrade-subversionsuse-upgrade-subversion-bash-completionsuse-upgrade-subversion-develsuse-upgrade-subversion-perlsuse-upgrade-subversion-pythonsuse-upgrade-subversion-python-ctypessuse-upgrade-subversion-rubysuse-upgrade-subversion-serversuse-upgrade-subversion-tools | Oct 26, 2022 | Apr 12, 2022 |
| Ubuntu | ubuntu-upgrade-libapache2-mod-svnubuntu-upgrade-libsvn-javaubuntu-upgrade-libsvn-perlubuntu-upgrade-libsvn1ubuntu-upgrade-python-subversionubuntu-upgrade-python3-subversionubuntu-upgrade-ruby-svnubuntu-upgrade-subversionubuntu-upgrade-subversion-tools | Apr 13, 2022 | Apr 12, 2022 | |
| Vmware Photon_os | vmware-photon_os_update_tdnf | Jan 20, 2025 | Apr 12, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub