Explore top 10 tips to secure your open-source projects now. Read More
×
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258
Subversion (SVN) is a concurrent version control system which enables one
or more users to collaborate in developing and maintaining a hierarchy of
files and directories while keeping a history of all changes. The
mod_dav_svn module is used with the Apache HTTP Server to allow access to
Subversion repositories via HTTP.
A flaw was found in the way the mod_dav_svn module handled OPTIONS
requests. A remote attacker with read access to an SVN repository served
via HTTP could use this flaw to cause the httpd process that handled such a
request to crash. (CVE-2014-0032)
A flaw was found in the way Subversion handled file names with newline
characters when the FSFS repository format was used. An attacker with
commit access to an SVN repository could corrupt a revision by committing a
specially crafted file. (CVE-2013-1968)
A flaw was found in the way the svnserve tool of Subversion handled remote
client network connections. An attacker with read access to an SVN
repository served via svnserve could use this flaw to cause the svnserve
daemon to exit, leading to a denial of service. (CVE-2013-2112)
All subversion users should upgrade to these updated packages, which
contain backported patches to correct these issues. After installing the
updated packages, for the update to take effect, you must restart the httpd
daemon, if you are using mod_dav_svn, and the svnserve daemon, if you are
serving Subversion repositories via the svn:// protocol.
https://access.redhat.com/security/cve/CVE-2013-1968 https://access.redhat.com/security/cve/CVE-2013-2112 https://access.redhat.com/security/cve/CVE-2014-0032 https://access.redhat.com/security/updates/classification/#moderate https://subversion.apache.org/security/CVE-2014-0032-advisory.txt https://subversion.apache.org/security/CVE-2013-1968-advisory.txt https://subversion.apache.org/security/CVE-2013-2112-advisory.txt
RHEL Desktop Workstation (v. 5 client):
Source:
i386:
mod_dav_svn-1.6.11-12.el5_10.i386.rpm
subversion-1.6.11-12.el5_10.i386.rpm
subversion-debuginfo-1.6.11-12.el5_10.i386.rpm
subversion-devel-1.6.11-12.el5_10.i386.rpm
subversion-javahl-1.6.11-12.el5_10.i386.rpm
subversion-perl-1.6.11-12.el5_10.i386.rpm
subversion-ruby-1.6.11-12.el5_10.i386.rpm
x86_64:
mod_dav_svn-1.6.11-12.el5_10.x86_64.rpm
subversion-1.6.11-12.el5_10.i386.rpm
subversion-1.6.11-12.el5_10.x86_64.rpm
subversion-debuginfo-1.6.11-12.el5_10.i386.rpm
subversion-debuginfo-1.6.11-12.el5_10.x86_64.rpm
subversion-devel-1.6.11-12.el5_10.i386.rpm
subversion-devel-1.6.11-12.el5_10.x86_64.rpm
subversion-javahl-1.6.11-12.el5_10.x86_64.rpm
subversion-perl-1.6.11-12.el5_10.x86_64.rpm
subversion-ruby-1.6.11-12.el5_10.x86_64.rpm
Red Hat Enterprise Linux (v. 5 server):
Source:
i386:
mod_dav_svn-1.6.11-12.el5_10.i386.rpm
subversion-1.6.11-12.el5_10.i386.rpm
subversion-debuginfo-1.6.11-12.el5_10.i386.rpm
subversion-devel-1.6.11-12.el5_10.i386.rpm
subversion-javahl-1.6.11-12.el5_10.i386.rpm
subversion-perl-1.6.11-12.el5_10.i386.rpm
subversion-ruby-1.6.11-12.el5_10.i386.rpm
ia64:
mod_dav_svn-1.6.11-12.el5_10.ia64.rpm
subversion-1.6.11-12.el5_10.ia64.rpm
subversion-debuginfo-1.6.11-12.el5_10.ia64.rpm
Read the Full Advisory
Updated subversion packages that fix three security issues are nowavailable for Red Hat Enterprise Linux 5 and 6.The Red Hat Security Response Team has rated this update as having Moderatesecurity impact. Common Vulnerability Scoring System (CVSS) base scores,which give detailed severity ratings, are available for each vulnerabilityfrom the CVE links in the References section.
RHEL Desktop Workstation (v. 5 client) - i386, x86_64
Red Hat Enterprise Linux (v. 5 server) - i386, ia64, ppc, s390x, x86_64
Red Hat Enterprise Linux Desktop Optional (v. 6) - i386, noarch, x86_64
Red Hat Enterprise Linux HPC Node Optional (v. 6) - noarch, x86_64
Red Hat Enterprise Linux Server (v. 6) - i386, ppc64, s390x, x86_64
Red Hat Enterprise Linux Server Optional (v. 6) - i386, noarch, ppc64, s390x, x86_64
Red Hat Enterprise Linux Workstation (v. 6) - i386, x86_64
Red Hat Enterprise Linux Workstation Optional (v. 6) - i386, noarch, x86_64
970014 - CVE-2013-1968 subversion (FSFS format): Filenames with newline character can lead to revision corruption
970037 - CVE-2013-2112 subversion: Remote DoS due improper handling of early-closing TCP connections
1062042 - CVE-2014-0032 subversion: mod_dav_svn crash when handling certain requests with SVNListParentPath on
Get the latest Linux and open source security news straight to your inbox.