Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 519
Alerts This Week
Warning Icon 1 519

CentOS: CESA-2014:0355-02 Low: Github Vulnerability Assessment

red hat
Calendar Grey March 5, 2014
Dist Redhat Esm H88
Enhanced subversion packages released by Red Hat address four average severity vulnerabilities. Make sure you apply the most recent updates.
Updated subversion packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Summary

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes. The mod_dav_svn module is used with the Apache HTTP Server to allow access to Subversion repositories via HTTP.
A flaw was found in the way the mod_dav_svn module handled OPTIONS requests. A remote attacker with read access to an SVN repository served via HTTP could use this flaw to cause the httpd process that handled such a request to crash. (CVE-2014-0032)
A flaw was found in the way Subversion handled file names with newline characters when the FSFS repository format was used. An attacker with commit access to an SVN repository could corrupt a revision by committing a specially crafted file. (CVE-2013-1968)
A flaw was found in the way the svnserve tool of Subversion handled remote client network connections. An attacker with read access to an SVN repository served via svnserve could use this flaw to cause the svnserve daemon to exit, leading to a denial of service. (CVE-2013-2112)
All subversion users should upgrade to these updated packages, which contain backported patches to correct these issues. After installing the updated packages, for the update to take effect, you must restart the httpd daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are serving Subversion repositories via the svn:// protocol.

References

https://access.redhat.com/security/cve/CVE-2013-1968 https://access.redhat.com/security/cve/CVE-2013-2112 https://access.redhat.com/security/cve/CVE-2014-0032 https://access.redhat.com/security/updates/classification/#moderate https://subversion.apache.org/security/CVE-2014-0032-advisory.txt https://subversion.apache.org/security/CVE-2013-1968-advisory.txt https://subversion.apache.org/security/CVE-2013-2112-advisory.txt

Package List

RHEL Desktop Workstation (v. 5 client):
Source:
i386: mod_dav_svn-1.6.11-12.el5_10.i386.rpm subversion-1.6.11-12.el5_10.i386.rpm subversion-debuginfo-1.6.11-12.el5_10.i386.rpm subversion-devel-1.6.11-12.el5_10.i386.rpm subversion-javahl-1.6.11-12.el5_10.i386.rpm subversion-perl-1.6.11-12.el5_10.i386.rpm subversion-ruby-1.6.11-12.el5_10.i386.rpm
x86_64: mod_dav_svn-1.6.11-12.el5_10.x86_64.rpm subversion-1.6.11-12.el5_10.i386.rpm subversion-1.6.11-12.el5_10.x86_64.rpm subversion-debuginfo-1.6.11-12.el5_10.i386.rpm subversion-debuginfo-1.6.11-12.el5_10.x86_64.rpm subversion-devel-1.6.11-12.el5_10.i386.rpm subversion-devel-1.6.11-12.el5_10.x86_64.rpm subversion-javahl-1.6.11-12.el5_10.x86_64.rpm subversion-perl-1.6.11-12.el5_10.x86_64.rpm subversion-ruby-1.6.11-12.el5_10.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
i386: mod_dav_svn-1.6.11-12.el5_10.i386.rpm subversion-1.6.11-12.el5_10.i386.rpm subversion-debuginfo-1.6.11-12.el5_10.i386.rpm subversion-devel-1.6.11-12.el5_10.i386.rpm subversion-javahl-1.6.11-12.el5_10.i386.rpm subversion-perl-1.6.11-12.el5_10.i386.rpm subversion-ruby-1.6.11-12.el5_10.i386.rpm
ia64: mod_dav_svn-1.6.11-12.el5_10.ia64.rpm subversion-1.6.11-12.el5_10.ia64.rpm subversion-debuginfo-1.6.11-12.el5_10.ia64.rpm

Read the Full Advisory


Advisory ID: RHSA-2014:0255-01
Product: Red Hat Enterprise Linux
Issue date: 2014-03-05

Topic

Updated subversion packages that fix three security issues are nowavailable for Red Hat Enterprise Linux 5 and 6.The Red Hat Security Response Team has rated this update as having Moderatesecurity impact. Common Vulnerability Scoring System (CVSS) base scores,which give detailed severity ratings, are available for each vulnerabilityfrom the CVE links in the References section.

Relevant Releases Architectures

RHEL Desktop Workstation (v. 5 client) - i386, x86_64

Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64

Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64

Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64

Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64

Red Hat Enterprise Linux Server Optional (v. 6) - i386, noarch, ppc64, s390x, x86_64

Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64

Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, noarch, x86_64

Bugs Fixed

970014 - CVE-2013-1968 subversion (FSFS format): Filenames with newline character can lead to revision corruption

970037 - CVE-2013-2112 subversion: Remote DoS due improper handling of early-closing TCP connections

1062042 - CVE-2014-0032 subversion: mod_dav_svn crash when handling certain requests with SVNListParentPath on

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.