Moderate: subversion:1.10 security update
Summary
ALSA-2020:4712: Moderate: subversion:1.10 security update. Affects libserf across 3 version ranges.
< 1.3.9-9.module_el8.3.0+2053+ac338b6d
< 1.3.9-9.module_el8.4.0+2266+ac338b6d
< 1.3.9-9.module_el8.6.0+2912+eb1cdf5a
Fixed in 1.3.9-9.module_el8.3.0+2053+ac338b6d, 1.3.9-9.module_el8.4.0+2266+ac338b6d or 1.3.9-9.module_el8.6.0+2912+eb1cdf5a, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Subversion (SVN) is a concurrent version control system that enables collaboration in developing and maintaining files and directories while keeping a history of changes. It is widely used in software development to manage source code. The package affected by this vulnerability is libserf, which is a high-performance asynchronous HTTP client library built upon the Apache Portable Runtime (APR) library. The vulnerability in subversion:1.10 can lead to a remotely triggerable denial-of-service (DoS) attack in the svnserve 'get-deleted-rev' function.
Vulnerability Detail
The vulnerability (CVE-2018-11782) allows an attacker to remotely trigger a DoS attack by exploiting a flaw in the svnserve 'get-deleted-rev' function. This can result in the svnserve process crashing, causing a disruption in the availability of the Subversion service. The impact of this vulnerability is considered moderate. The Common Vulnerability Scoring System (CVSS) score and other related information can be found in the CVE page linked in the References section.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libserf-
< 1.3.9-9.module_el8.3.0+2053+ac338b6d1.3.9-9.module_el8.3.0+2053+ac338b6d -
< 1.3.9-9.module_el8.4.0+2266+ac338b6d1.3.9-9.module_el8.4.0+2266+ac338b6d -
< 1.3.9-9.module_el8.6.0+2912+eb1cdf5a1.3.9-9.module_el8.6.0+2912+eb1cdf5a
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the subversion:1.10 security update addresses a moderate vulnerability in the libserf package. It is recommended to update to the specified version or later to mitigate the remotely triggerable DoS vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libserf →
FAQ
Subversion (SVN) is a concurrent version control system used for managing and tracking changes to files and directories in software development projects.
libserf is a high-performance asynchronous HTTP client library built upon the Apache Portable Runtime (APR) library. It is used by Subversion for handling HTTP requests.
The vulnerability allows for a remotely triggerable denial-of-service (DoS) attack, which can disrupt the availability of the Subversion service.
To fix this vulnerability, update the libserf package to version 1.3.9-9.module_el8.3.0+2053+ac338b6d or later.
You can find more information about this vulnerability, including the CVSS score and related details, in the CVE page linked in the References section.
References
Related vulnerabilities
Recent vulnerabilities recorded for libserf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
