Critical Vulnerability in Subversion: Potential Crash Due to In-Repository Authz Rules
Summary
ALPINE-CVE-2020-17525: Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. Affects subversion versions < 1.12.2-r1. Fixed in 1.12.2-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Subversion is a widely used version control system that allows developers to manage changes to source code over time. It supports various functionalities such as branching, merging, and version tracking. The package's mod_authz_svn module is responsible for authorization controls, ensuring that users have appropriate access to repositories. However, a vulnerability has been identified that can lead to server crashes under specific conditions, impacting service availability.
Vulnerability Detail
The vulnerability arises from the mod_authz_svn module crashing when the server is configured to use in-repository authorization rules with the AuthzSVNReposRelativeAccessFile option. If a client sends a request for a non-existing repository URL, the server fails to handle this gracefully, leading to a crash. This disruption can affect all users relying on the service, making it critical to address this issue promptly. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
1.12.2-r1
This is the first release that contains the fix.
sudo apk add --upgrade subversionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider disabling the AuthzSVNReposRelativeAccessFile option in your server configuration until the package can be updated. This can prevent the server from crashing due to unauthorized access requests.
Conclusion
The identified vulnerability in the Subversion package poses a significant risk to server stability and user access. It is crucial to update to the latest patched versions to ensure continued service availability and security. Utilizing tools like Vulert can help monitor for such vulnerabilities effectively.
See every vulnerability recorded for subversion →
FAQ
The vulnerability causes the Subversion server to crash when a request is made for a non-existing repository URL while using specific authorization rules.
The crash can lead to service disruption for all users accessing the Subversion server, affecting productivity and project timelines.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application against this vulnerability using the Vulert playground at Vulert Scanner.
Yes, patched versions of the Subversion package are available. Ensure you update to the specified versions to mitigate the risk.
If immediate updating is not possible, consider disabling the AuthzSVNReposRelativeAccessFile option as a temporary workaround to prevent crashes.
References
Related vulnerabilities
Recent vulnerabilities recorded for subversion.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
