Important: subversion:1.10 security update
Summary
RLSA-2022:2234: Important: subversion:1.10 security update. Affects libserf across 2 version ranges.
< 0:1.3.9-9.module+el8.7.0+1065+42200b2e
< 0:1.3.9-9.module+el8.4.0+407+38733e5a
Fixed in 0:1.3.9-9.module+el8.7.0+1065+42200b2e or 0:1.3.9-9.module+el8.4.0+407+38733e5a, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Subversion (SVN) is a concurrent version control system that enables collaboration in developing and maintaining files and directories while keeping a history of changes. It is widely used in software development projects to manage source code. The package affected by this vulnerability is subversion:1.10.
Vulnerability Detail
The vulnerability (CVE-2022-24070) affects Subversion's mod_dav_svn and can lead to memory corruption. This vulnerability could potentially be exploited by an attacker to execute arbitrary code or cause a denial of service. The CVSS score for this vulnerability is 7.5, indicating a high severity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libserf-
< 0:1.3.9-9.module+el8.4.0+407+38733e5a0:1.3.9-9.module+el8.4.0+407+38733e5a -
< 0:1.3.9-9.module+el8.7.0+1065+42200b2e0:1.3.9-9.module+el8.7.0+1065+42200b2e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Conclusion
In conclusion, the subversion:1.10 package is vulnerable to memory corruption. It is crucial to update to version 1.10.2-5.module+el8.7.0+1065+42200b2e or later to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libserf →
FAQ
Subversion (SVN) is a concurrent version control system used for managing source code and facilitating collaboration among developers.
mod_dav_svn is a module in Subversion that provides support for accessing repositories via the WebDAV protocol.
Memory corruption refers to the unintended modification of data in a computer's memory. In the context of this vulnerability, it can lead to security issues and potential exploitation.
CVSS (Common Vulnerability Scoring System) is a framework used to assess the severity of vulnerabilities. The score helps to prioritize the response and remediation efforts.
You can update the subversion package by running the appropriate package manager command for your operating system. For example, on Rocky Linux 8, you can use 'yum update subversion' to install the latest version.
Related vulnerabilities
Recent vulnerabilities recorded for libserf.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
