Subversion - Security Update
Summary
DSA-3331-1: subversion - security update. Affects subversion versions < 1.6.17dfsg-4+deb7u10. Fixed in 1.6.17dfsg-4+deb7u10. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subversion is a version control system used for tracking changes in files and directories. It allows multiple users to collaborate on a project by managing different versions of files. Subversion includes server components, such as mod_authz_svn, which handle authentication and authorization for accessing files. These server components are vulnerable to certain security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2015-3184, affects Subversion's mod_authz_svn when used with Apache httpd 2.4 in mixed anonymous/authenticated environments. It fails to properly restrict anonymous access, potentially allowing unauthorized access to files that should only be accessible to authenticated users. This vulnerability does not impact the oldstable distribution (wheezy) as it uses Apache httpd 2.2.
The second vulnerability, CVE-2015-3187, affects both Subversion servers (httpd and svnserve). It allows the revelation of paths that should be hidden by path-based authorization (authz). When a node is copied from an unreadable location to a readable location, the previously unreadable path may be exposed. However, this vulnerability only reveals the path and does not disclose the contents of the path.
How To Fix
Minimum fixed version
1.6.17dfsg-4+deb7u10
This is the first release that contains the fix.
sudo apt-get install --only-upgrade subversionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
Upgrading your Subversion packages to the fixed versions mentioned in the vulnerability report is crucial to mitigate the identified security issues. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for subversion →
FAQ
The vulnerabilities impact Subversion versions used in the Debian distributions wheezy, jessie, stretch, and sid.
CVE-2015-3184 can allow anonymous access to files that should only be accessible to authenticated users in certain mixed anonymous/authenticated environments.
No, CVE-2015-3187 only reveals the path and does not disclose the contents of the path.
No specific workarounds are mentioned in the vulnerability report. It is recommended to upgrade to the fixed versions of Subversion.
You can find more information about these vulnerabilities in the Debian Security Advisory DSA-3331-1.
Related vulnerabilities
Recent vulnerabilities recorded for subversion.
