PT-2014-1443 · Apache+2 · Apache Subversion+2

Published 2014-08-12 · Updated 2024-06-15 · CVE-2014-3522

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.4.0 through 1.7.x before 1.7.18 Apache Subversion versions 1.8.x before 1.8.10

Description The issue exists due to incorrect handling of wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate in the Serf RA layer. This allows an attacker to spoof servers using a specially crafted certificate, potentially leading to man-in-the-middle attacks.

Recommendations For Apache Subversion versions 1.4.0 through 1.7.x before 1.7.18, update to version 1.7.18 or later. For Apache Subversion versions 1.8.x before 1.8.10, update to version 1.8.10 or later.

Fix

Weakness Enumeration

CWE-297

Related Identifiers

ALT-PU-2015-1708

BDU:2015-00405

CVE-2014-3522

MGASA-2014-0339

OPENSUSE-SU-2024:10538-1

USN-2316-1

Affected Products

Alt Linux

Apache Subversion

Ubuntu

References · 94

• https://cve.org/CVERecord?id=CVE-2014-3522 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4131 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-3522 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-3522 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1845 · Security Note
• https://security.gentoo.org/glsa/201610-05 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0251 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3580 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0032 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3504 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3522 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2112 · Security Note
• https://advisories.mageia.org/MGASA-2014-0339.html · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528 · Security Note