FreshPorts - VuXML

Subversion project reports:

svnserve, the svn:// protocol server, can optionally use the Cyrus SASL library for authentication, integrity protection, and encryption. Due to a programming oversight, authentication against Cyrus SASL would permit the remote user to specify a realm string which is a prefix of the expected realm string.

Subversion's httpd servers are vulnerable to a remotely triggerable crash in the mod_authz_svn module. The crash can occur during an authorization check for a COPY or MOVE request with a specially crafted header value.

This allows remote attackers to cause a denial of service.

ge 1.9.0 lt 1.9.4

ge 1.0.0 lt 1.8.15

ge 1.0.0 lt 1.8.15

Subversion Project reports:

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a REPORT request for some invalid formatted special URIs.

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives a request for some invalid formatted special URIs.

We consider this to be a medium risk vulnerability. Repositories which allow for anonymous reads will be vulnerable without authentication. Unfortunately, no special configuration is required and all mod_dav_svn servers are vulnerable.

ge 1.8.0 lt 1.8.11

ge 1.0.0 lt 1.7.19

ge 1.0.0 lt 1.7.19

ge 1.0.0 lt 1.7.19

ge 1.8.0 lt 1.8.11

Subversion Project reports:

Subversion HTTP servers with FSFS repositories are vulnerable to a remotely triggerable excessive memory use with certain REPORT requests.

Subversion mod_dav_svn and svnserve are vulnerable to a remotely triggerable assertion DoS vulnerability for certain requests with dynamically evaluated revision numbers.

Subversion HTTP servers allow spoofing svn:author property values for new revisions.

ge 1.5.0 lt 1.7.20

ge 1.8.0 lt 1.8.13

ge 1.0.0 lt 1.7.20

ge 1.0.0 lt 1.7.20

ge 1.0.0 lt 1.7.20

ge 1.8.0 lt 1.8.13

Subversion Project reports:

Using the Serf RA layer of Subversion for HTTPS uses the apr_fnmatch API to handle matching wildcards in certificate Common Names and Subject Alternate Names. However, apr_fnmatch is not designed for this purpose. Instead it is designed to behave like common shell globbing. In particular this means that '*' is not limited to a single label within a hostname (i.e. it will match '.'). But even further apr_fnmatch supports '?' and character classes (neither of which are part of the RFCs defining how certificate validation works).

Subversion stores cached credentials by an MD5 hash based on the URL and the authentication realm of the server the credentials are cached for. MD5 has been shown to be subject to chosen plaintext hash collisions. This means it may be possible to generate an authentication realm which results in the same MD5 hash for a different URL.

ge 1.0.0 lt 1.7.18

ge 1.0.0 lt 1.7.18

ge 1.0.0 lt 1.7.18

ge 1.8.0 lt 1.8.10

The Apache Software Foundation reports:

The mod_dontdothat module of subversion and subversion clients using http(s):// are vulnerable to a denial-of-service attack, caused by exponential XML entity expansion. The attack targets XML parsers causing targeted process to consume excessive amounts of resources. The attack is also known as the "billions of laughs attack."

< 1.8.17

< 1.9.5

Subversion reports:

CVE-2015-3184:

Subversion's mod_authz_svn does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Apache httpd 2.4.

CVE-2015-3187:

Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz.

ge 1.8.0 lt 1.8.14

ge 1.7.0 lt 1.7.21

Subversion Project reports:

mod_dontdothat does not restrict requests from serf based clients

mod_dontdothat allows you to block update REPORT requests against certain paths in the repository. It expects the paths in the REPORT request to be absolute URLs. Serf based clients send relative URLs instead of absolute URLs in many cases. As a result these clients are not blocked as configured by mod_dontdothat.

mod_dav_svn assertion triggered by non-canonical URLs in autoversioning commits

When SVNAutoversioning is enabled via SVNAutoversioning on commits can be made by single HTTP requests such as MKCOL and PUT. If Subversion is built with assertions enabled any such requests that have non-canonical URLs, such as URLs with a trailing /, may trigger an assert. An assert will cause the Apache process to abort.

ge 1.4.0 lt 1.7.14

ge 1.8.0 lt 1.8.5

Subversion Project reports:

Subversion's mod_dav_svn Apache HTTPD server module will crash when it receives an OPTIONS request against the server root and Subversion is configured to handle the server root and SVNListParentPath is on. This can lead to a DoS. There are no known instances of this problem being exploited in the wild, but the details of how to exploit it have been disclosed on the Subversion development mailing list.

ge 1.3.0 lt 1.7.16

ge 1.8.0 lt 1.8.8

ge 1.3.0 lt 1.7.16

ge 1.3.0 lt 1.7.16