Critical Vulnerability in Subversion Package: Uninitialized Pointer Dereference
Summary
ALPINE-CVE-2018-11803: Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a recursive directory listing operation. Affects subversion versions < 1.11.1-r0. Fixed in 1.11.1-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subversion is an open-source version control system that allows developers to manage changes to source code over time. It is widely used for collaborative development and supports various features such as branching, merging, and version tracking. However, certain versions of Subversion's mod_dav_svn Apache HTTPD module are vulnerable to a critical issue that can lead to application crashes, affecting the stability and reliability of systems relying on this package.
Vulnerability Detail
The vulnerability, identified as CVE-2018-11803, arises from an uninitialized pointer dereference in Subversion's mod_dav_svn module. Specifically, versions 1.11.0 and 1.10.0 to 1.10.3 are affected. When a client omits the root path during a recursive directory listing operation, the module crashes due to dereferencing this uninitialized pointer. This can lead to denial of service, making the application unavailable to users. The CVSS score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.11.1-r0
This is the first release that contains the fix.
sudo apk add --upgrade subversionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can configure your Apache server to restrict access to the mod_dav_svn module or disable it until the package can be updated. This can be done by commenting out the relevant lines in your Apache configuration file.
Conclusion
The CVE-2018-11803 vulnerability in Subversion's mod_dav_svn module poses a significant risk to applications relying on this package. It is crucial to update to the patched version to mitigate the risk of denial of service. Additionally, using tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for subversion →
FAQ
CVE-2018-11803 is a vulnerability in Subversion's mod_dav_svn module that can cause application crashes due to an uninitialized pointer dereference.
The affected versions include Subversion 1.11.0 and 1.10.0 to 1.10.3.
The vulnerability can lead to denial of service, making the application unavailable to users.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring access to the code.
If an immediate update is not possible, consider implementing a temporary workaround by restricting access to the mod_dav_svn module in your Apache configuration.
References
Related vulnerabilities
Recent vulnerabilities recorded for subversion.
