PT-2016-7558 · Apache+3 · Apache Subversion+3

Publicado 2016-11-30 · Atualizado 2024-06-15 · CVE-2016-8734

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.4.0 through 1.8.16 Apache Subversion versions 1.9.0 through 1.9.4

Description The issue is caused by exponential XML entity expansion, which can lead to a denial-of-service attack. This attack can cause the targeted process to consume an excessive amount of CPU resources or memory.

Recommendations For versions 1.4.0 through 1.8.16, update to a version outside of this range to mitigate the risk. For versions 1.9.0 through 1.9.4, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting the use of the mod dontdothat module until a patch is available.

Correção

DoS

Resource Exhaustion

Enumeração de Fraquezas

CWE-400

Identificadores relacionados

ALT-PU-2020-1641

ALT-PU-2020-2914

CVE-2016-8734

DSA-3932-1

MGASA-2017-0009

OPENSUSE-SU-2024:10538-1

SUSE-SU-2017:2163-1

SUSE-SU-2017:2200-1

SUSE-SU-2017_2163-1

USN-3388-1

Produtos afetados

Alt Linux

Apache Subversion

Suse

Ubuntu

Referências · 109

• https://bdu.fstec.ru/vul/2017-02070 · Nota de Segurança
• https://bugzilla.suse.com/923795 · Nota
• https://ubuntu.com/security/CVE-2016-8734 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2015-0248 · Nota
• https://packages.altlinux.org/ru/vuln/CVE-2016-8734 · Nota
• https://ubuntu.com/security/CVE-2017-9800 · Aviso do Fabricante
• https://bugzilla.suse.com/923793 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5259 · Nota de Segurança
• https://suse.com/security/cve/CVE-2013-1849 · Nota
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Aviso do Fabricante
• https://suse.com/security/cve/CVE-2013-2088 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8734 · Nota de Segurança
• https://subversion.apache.org/security/CVE-2016-8734-advisory.txt · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2016-8734 · Aviso do Fabricante
• https://bugzilla.suse.com/911620 · Nota