CVE-2020-17525: subversion - mod_authz_svn Crash
Summary
DLA-2646-1: subversion - security update. Affects subversion versions < 1.9.5-1+deb9u6. Fixed in 1.9.5-1+deb9u6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subversion is a version control system commonly used for managing source code repositories. It provides functionality for tracking changes, merging code, and collaborating on software development projects. The mod_authz_svn module in Subversion is responsible for handling authorization rules for repository access. This module can be configured to use in-repository authz rules with the AuthzSVNReposRelativeAccessFile option, allowing fine-grained control over user permissions. However, a vulnerability has been discovered in this module that can lead to a crash under specific conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2020-17525, occurs when a client sends a request for a non-existing repository URL while the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option. In such cases, Subversion's mod_authz_svn module crashes, resulting in a disruption of service for users. This vulnerability can be exploited by an attacker to cause denial of service, potentially impacting the availability of the Subversion service. It is important to note that this vulnerability does not allow arbitrary code execution or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
1.9.5-1+deb9u6
This is the first release that contains the fix.
sudo apt-get install --only-upgrade subversionTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is necessary to apply the provided security update to mitigate the risk.
Conclusion
The vulnerability in Subversion's mod_authz_svn module can result in a crash when handling requests for non-existing repository URLs. To mitigate this issue, it is crucial to upgrade the subversion package to version 1.9.5-1+deb9u6 or later. This security update addresses the vulnerability and prevents disruption of the Subversion service. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for subversion →
FAQ
Subversion is a version control system used for managing source code repositories. It allows multiple developers to work on a project simultaneously, keeping track of changes and facilitating collaboration.
The mod_authz_svn module is a component of Subversion that handles authorization rules for repository access. It allows administrators to define fine-grained permissions for users and groups.
The vulnerability in the mod_authz_svn module can cause a crash when a client sends a request for a non-existing repository URL. This can disrupt the Subversion service, affecting its availability for users.
No, this vulnerability does not allow arbitrary code execution. It only leads to a crash of the mod_authz_svn module, resulting in a denial of service.
No, this vulnerability does not grant unauthorized access to sensitive information. It is limited to causing a crash of the mod_authz_svn module.
Related vulnerabilities
Recent vulnerabilities recorded for subversion.
