PT-2013-5073 · Apache+1 · Subversion+1

Philip Martin · Publicado 2013-11-30 · Atualizado 2024-06-15 · CVE-2013-4558

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Subversion versions 1.7.11 through 1.7.13 Subversion versions 1.8.1 through 1.8.4

Description The issue allows remote attackers to cause a denial of service, resulting in an assertion failure and Apache process abort, via a non-canonical URL in a request. This can be demonstrated using a trailing /. The problem occurs when the get parent resource function in repos.c is used with assertions enabled and SVNAutoversioning is enabled.

Recommendations For Subversion versions 1.7.11 through 1.7.13, consider disabling SVNAutoversioning to minimize the risk of exploitation until a patch is available. For Subversion versions 1.8.1 through 1.8.4, consider disabling SVNAutoversioning to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider restricting access to non-canonical URLs to prevent the denial of service.

Correção

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-4558

MGASA-2013-0360

OPENSUSE-SU-2024:10538-1

SUSE-SU-2015:0709-1

Produtos afetados

Subversion

Suse

Referências · 59

• https://github.com/apache/subversion/commit/2c77c43e4255555f3b79f761f0d141393a3856cc · Nota
• https://github.com/apache/subversion/commit/647e3f8365a74831bb915f63793b63e31fae062d · Nota
• https://suse.com/security/cve/CVE-2015-3184 · Nota
• https://suse.com/security/cve/CVE-2013-1846 · Nota
• https://suse.com/security/cve/CVE-2016-2168 · Nota
• https://suse.com/security/cve/CVE-2015-3187 · Nota
• http://osvdb.org/100363 · Nota
• https://suse.com/security/cve/CVE-2015-0251 · Nota
• https://suse.com/security/cve/CVE-2010-4644 · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2013-4558 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4558 · Nota
• https://suse.com/security/cve/CVE-2016-8734 · Nota
• https://suse.com/security/cve/CVE-2013-1968 · Nota
• https://suse.com/security/cve/CVE-2011-1783 · Nota
• https://suse.com/security/cve/CVE-2014-0032 · Nota