Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges

Alerts This Week
Warning Icon 1 488
Alerts This Week
Warning Icon 1 488

SUSE: 2022:1483-1 Important Memory Corruption Fix - DoS Risk

suse
Calendar Grey May 2, 2022
Scroller Suse
Important security patch released for SUSE Subversion addressing memory corruption and data exposure vulnerabilities. Take immediate action!
An update that solves two vulnerabilities and has one errata is now available

Summary

This update for subversion fixes the following issues: - CVE-2022-24070: Fixed a memory corruption issue in mod_dav_svn as used by Apache HTTP server. This could be exploited by a remote attacker to cause a denial of service (bsc#1197940). - CVE-2021-28544: Fixed an information leak issue where Subversion servers may reveal the original path of files protected by path-based authorization (bsc#1197939). The following non-security bugs were fixed: - Skip failing test on s390[x] (bsc#1198503). Patch Instructions: To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". Alternatively you can run the command listed for your product: - SUSE Linux Enterprise Software Development Kit 12-SP5: zypper in -t patch SUSE-SLE-SDK-12-SP5-2022-1483=1

Topics%20covered

Topics Covered

security advisory denial of service information leak memory corruption important SUSE

References

#1197939 #1197940 #1198503

Cross- CVE-2021-28544 CVE-2022-24070

CVSS scores:

CVE-2021-28544 (NVD) : 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVE-2021-28544 (SUSE): 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

CVE-2022-24070 (NVD) : 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVE-2022-24070 (SUSE): 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products:

SUSE Linux Enterprise Server 12-SP5

SUSE Linux Enterprise Server for SAP Applications 12-SP5

SUSE Linux Enterprise Software Development Kit 12-SP5

https://www.suse.com/security/cve/CVE-2021-28544.html

https://www.suse.com/security/cve/CVE-2022-24070.html

https://bugzilla.suse.com/1197939

https://bugzilla.suse.com/1197940

https://bugzilla.suse.com/1198503

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2022:1483-1
Rating: important

Topics%20covered

Topics Covered

security advisory denial of service information leak memory corruption important SUSE

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.