Important: subversion:1.14 security update
Summary
RLSA-2022:4941: Important: subversion:1.14 security update. Affects libserf across 2 version ranges.
< 0:1.3.9-9.module+el8.7.0+1065+42200b2e
< 0:1.3.9-9.module+el8.4.0+407+38733e5a
Fixed in 0:1.3.9-9.module+el8.7.0+1065+42200b2e or 0:1.3.9-9.module+el8.4.0+407+38733e5a, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Subversion (SVN) is a concurrent version control system that enables collaboration in developing and maintaining files and directories while keeping a history of changes. It is widely used in software development projects to manage source code. The package affected by this vulnerability is subversion:1.14.
Vulnerability Detail
The vulnerability (CVE-2022-24070) affects Subversion's mod_dav_svn and is related to memory corruption. An attacker could exploit this vulnerability to cause memory corruption, potentially leading to arbitrary code execution or denial of service attacks. The vulnerability has a CVSS score of 7.5, indicating its importance and potential impact.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
sudo dnf update libserf-
< 0:1.3.9-9.module+el8.4.0+407+38733e5a0:1.3.9-9.module+el8.4.0+407+38733e5a -
< 0:1.3.9-9.module+el8.7.0+1065+42200b2e0:1.3.9-9.module+el8.7.0+1065+42200b2e
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
In conclusion, the subversion:1.14 package is vulnerable to a memory corruption issue in mod_dav_svn. It is crucial to update the package to version 1.14.1-2.module+el8.7.0+1066+f8abeb19 or later to mitigate the risk of arbitrary code execution or denial of service attacks. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libserf →
FAQ
Subversion (SVN) is a concurrent version control system used for managing source code and files in software development projects.
mod_dav_svn is a module in Subversion that provides support for the WebDAV protocol, allowing users to access and manage Subversion repositories over HTTP or HTTPS.
Memory corruption refers to the unintended modification of data in a computer's memory. In the context of this vulnerability, it can lead to various security issues, including arbitrary code execution or denial of service attacks.
CVSS (Common Vulnerability Scoring System) is a standardized method to assess the severity and potential impact of security vulnerabilities. The score ranges from 0 to 10, with higher scores indicating more severe vulnerabilities.
You can update the subversion package by running the appropriate package management command, such as 'yum update subversion' or 'dnf upgrade subversion'. Make sure to use the correct package repository and version for your operating system.
Related vulnerabilities
Recent vulnerabilities recorded for libserf.
