Subversion - Authentication Bypass and Denial of Service Vulnerabilities
Summary
DSA-3561-1: subversion - security update. Affects subversion versions < 1.8.10-6+deb8u4. Fixed in 1.8.10-6+deb8u4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subversion is a popular version control system used for managing and tracking changes to files and directories. It provides a centralized repository for developers to collaborate on projects and maintain a history of changes. Subversion is widely used in software development and other industries to manage source code and track revisions. However, several vulnerabilities have been discovered in Subversion that could potentially allow remote attackers to bypass authentication and cause denial of service.
Vulnerability Detail
Two vulnerabilities have been identified in Subversion:
-
Authentication Bypass (CVE-2016-2167): This vulnerability allows a remote user to specify a realm string that is a prefix of the expected realm string during authentication. This could potentially lead to the user authenticating with the wrong realm and gaining unauthorized access.
-
Denial of Service (CVE-2016-2168): This vulnerability can be triggered by an authenticated remote attacker during COPY or MOVE authorization check. By sending specially crafted headers in COPY or MOVE requests, the attacker can cause a Subversion server crash, resulting in a denial of service.
How To Fix
Minimum fixed version
1.8.10-6+deb8u4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade subversionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the recommended fixes by upgrading to the latest version of Subversion.
Conclusion
Subversion is susceptible to an authentication bypass vulnerability and a denial of service vulnerability. It is crucial to upgrade to the latest version of Subversion to mitigate these risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for subversion →
FAQ
Subversion is a version control system used for managing and tracking changes to files and directories. It provides a centralized repository for developers to collaborate on projects and maintain a history of changes.
The authentication bypass vulnerability allows a remote user to authenticate with the wrong realm, potentially gaining unauthorized access to Subversion repositories and sensitive information.
To fix the vulnerabilities, upgrade to the latest version of Subversion (1.8.10-6+deb8u4 for the stable distribution and 1.9.4-1 for the unstable distribution).
There are no known workarounds for these vulnerabilities. It is crucial to apply the recommended fixes by upgrading Subversion.
You can obtain the updated packages from the official Subversion website or through your package manager.
Related vulnerabilities
Recent vulnerabilities recorded for subversion.
