security advisorydenial of servicesubversion
Several problems were discovered in Subversion, a centralised version control system. CVE-2016-8734 (jessie only) . - ------------------------------------------------------------------------- Debian Security Advisory DSA-3932-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/security/ Sebastien Delafond August 10, 2017 https://www.debian.org/security/faq - ------------------------------------------------------------------------- Package : subversion CVE ID : CVE-2016-8734 CVE-2017-9800 Several problems were discovered in Subversion, a centralised version control system. CVE-2016-8734 (jessie only) Subversion's mod_dontdothat server module and Subversion clients using http(s):// were vulnerable to a denial-of-service attack caused by exponential XML entity expansion. CVE-2017-9800 Joern Schneeweisz discovered that Subversion did not correctly handle maliciously constructed svn+ssh:// URLs. This allowed an attacker to run an arbitrary shell command, for instance via svn:externals properties or when using 'svnsync sync'. For the oldstable distribution (jessie), these problems have been fixed in version 1.8.10-6+deb8u5. For the stable distribution (stretch), these problems have been fixed in version 1.9.5-1+deb9u1. We recommend that you upgrade your subversion packages. Further information about Debian Security Advisories, how to apply these updates to your system and frequently asked questions can be found at: https://www.debian.org/security/ Mailing list: This email address is being protected from spambots. You need JavaScript enabled to view it. . Important patch for Subversion released to fix security vulnerabilities related to denial of service and unauthorized command execution. Ensure your setup is updated immediately.. Debian Security, Subversion Update, DoS Attack, Security Issues. . Severity: Critical. LinuxSecurity.com Team
Aug 10, 2017
•Critical
Debian