Apache Subversion Filename Validation Vulnerability in Subversion Package
Summary
ALPINE-CVE-2024-46901: Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption... Affects subversion versions < 1.14.5-r0. Fixed in 1.14.5-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Subversion is a version control system that allows multiple users to collaborate on projects by tracking changes to files and directories. It is widely used for managing source code and other collections of files. The Subversion package in Alpine Linux provides the necessary tools to interact with Subversion repositories. However, a recent vulnerability has been identified that affects the integrity of repositories served via mod_dav_svn.
Vulnerability Detail
The vulnerability arises from insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn. This flaw allows authenticated users with commit access to submit a corrupted revision, potentially disrupting the functionality of the repository for all users. All versions of Subversion up to and including 1.14.4 are affected, making it crucial for users to upgrade to the patched version to mitigate risks.
How To Fix
Minimum fixed version
1.14.5-r0
This is the first release that contains the fix.
sudo apk add --upgrade subversionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for this vulnerability. The best course of action is to upgrade to the patched version as soon as possible.
Conclusion
In summary, the Apache Subversion package has a vulnerability related to filename validation that affects repositories served via mod_dav_svn. Users are strongly advised to upgrade to version 1.14.5 or later to mitigate the risks associated with this vulnerability.
See every vulnerability recorded for subversion →
FAQ
The CVSS score of this vulnerability is 4.3, indicating a moderate level of severity.
All versions of Subversion up to and including 1.14.4 are affected by this vulnerability.
The potential consequences include the ability for authenticated users to commit corrupted revisions, leading to disruptions for all users of the repository.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By using the Vulert playground, you can check if your application is affected by this vulnerability without any signup.
While there are no specific workarounds, it is recommended to prioritize the upgrade to the patched version to ensure the security of your repositories.
References
Related vulnerabilities
Recent vulnerabilities recorded for subversion.
