Important: subversion:1.10 security update
Summary
ALSA-2022:2234: Important: subversion:1.10 security update. Affects libserf across 3 version ranges.
< 1.3.9-9.module_el8.3.0+2053+ac338b6d
< 1.3.9-9.module_el8.4.0+2266+ac338b6d
< 1.3.9-9.module_el8.6.0+2912+eb1cdf5a
Fixed in 1.3.9-9.module_el8.3.0+2053+ac338b6d, 1.3.9-9.module_el8.4.0+2266+ac338b6d or 1.3.9-9.module_el8.6.0+2912+eb1cdf5a, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subversion (SVN) is a concurrent version control system that enables collaboration in developing and maintaining files and directories while keeping a history of changes. It is widely used in software development to manage source code. The package affected by this vulnerability is subversion:1.10.
Vulnerability Detail
The vulnerability (CVE-2022-24070) affects Subversion's mod_dav_svn component and involves memory corruption. This vulnerability could potentially be exploited by an attacker to execute arbitrary code or cause a denial of service. It is rated as important.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libserf-
< 1.3.9-9.module_el8.3.0+2053+ac338b6d1.3.9-9.module_el8.3.0+2053+ac338b6d -
< 1.3.9-9.module_el8.4.0+2266+ac338b6d1.3.9-9.module_el8.4.0+2266+ac338b6d -
< 1.3.9-9.module_el8.6.0+2912+eb1cdf5a1.3.9-9.module_el8.6.0+2912+eb1cdf5a
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability. Updating to the fixed version is the recommended solution.
Conclusion
It is crucial to update the subversion package to the fixed version to mitigate the risk of exploitation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libserf →
FAQ
Subversion (SVN) is a concurrent version control system used for managing source code and versioning files and directories.
mod_dav_svn is a module in Subversion that provides support for accessing repositories via the WebDAV protocol.
Memory corruption refers to the unintended modification of data in a computer's memory. In the context of this vulnerability, it can lead to security issues and potential exploitation.
This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service on systems running the affected version of Subversion.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your system is affected by this vulnerability. Simply upload your manifest file (e.g., package-lock.json) to the playground and it will alert you in real-time.
References
Related vulnerabilities
Recent vulnerabilities recorded for libserf.
