CVE-2024-46901: Apache Subversion Filename Validation Vulnerability
Summary
CVE-2024-46901: Apache Subversion: mod_dav_svn denial-of-service via control characters in paths. Affects subversion versions < 1.14.5. Fixed in 1.14.5. How to fix ↓
Also tracked for
- subversion · Alpine:v3.18
The same CVE-2024-46901 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Subversion is a widely used version control system that allows developers to manage changes to source code over time. It supports various access methods, including HTTP and SVN protocols, enabling collaborative software development. However, a vulnerability has been identified in versions up to 1.14.4 when repositories are served via mod_dav_svn, which could allow authenticated users to disrupt repository functionality.
Vulnerability Detail
The vulnerability arises from insufficient validation of filenames against control characters in Apache Subversion repositories. This flaw permits authenticated users with commit access to submit a corrupted revision, potentially leading to significant disruption for other users accessing the repository. All versions of Subversion up to and including 1.14.4 are affected when using mod_dav_svn, while repositories accessed through other methods remain unaffected.
How To Fix
Minimum fixed version
1.14.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can restrict commit access to trusted users only, thereby minimizing the risk of corrupted revisions being committed until the upgrade is completed.
Conclusion
The CVE-2024-46901 vulnerability in Apache Subversion poses a risk to users by allowing corrupted revisions to be committed. It is crucial for users to upgrade to version 1.14.5 or later to protect their repositories from potential disruptions. Temporary workarounds can help mitigate risks until the upgrade is completed.
See every vulnerability recorded for subversion →
FAQ
CVE-2024-46901 is a vulnerability in Apache Subversion that allows authenticated users to commit corrupted revisions due to insufficient filename validation.
All versions of Subversion up to and including 1.14.4 are affected when repositories are served via mod_dav_svn.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application against CVE-2024-46901 using the Vulert playground at Vulert Scanner.
If an immediate upgrade is not possible, consider restricting commit access to trusted users to mitigate the risk of disruption.
More information can be found in the official Apache Subversion release notes and security advisories.
Related vulnerabilities
Recent vulnerabilities recorded for subversion.
