PT-2016-7558 · Apache+3 · Apache Subversion+3

Published 2016-11-30 · Updated 2024-06-15 · CVE-2016-8734

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Apache Subversion versions 1.4.0 through 1.8.16 Apache Subversion versions 1.9.0 through 1.9.4

Description The issue is caused by exponential XML entity expansion, which can lead to a denial-of-service attack. This attack can cause the targeted process to consume an excessive amount of CPU resources or memory.

Recommendations For versions 1.4.0 through 1.8.16, update to a version outside of this range to mitigate the risk. For versions 1.9.0 through 1.9.4, update to a version outside of this range to mitigate the risk. As a temporary workaround, consider restricting the use of the mod dontdothat module until a patch is available.

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

ALT-PU-2020-1641

ALT-PU-2020-2914

CVE-2016-8734

DSA-3932-1

MGASA-2017-0009

OPENSUSE-SU-2024:10538-1

SUSE-SU-2017:2163-1

SUSE-SU-2017:2200-1

SUSE-SU-2017_2163-1

USN-3388-1

Affected Products

Alt Linux

Apache Subversion

Suse

Ubuntu

References · 109

• https://bdu.fstec.ru/vul/2017-02070 · Security Note
• https://ubuntu.com/security/CVE-2016-8734 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9800 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5259 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2024:10538-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-8734 · Security Note
• https://subversion.apache.org/security/CVE-2016-8734-advisory.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8734 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2016-8734 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-8734 · Security Note
• https://ubuntu.com/security/notices/USN-3388-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2016-8734 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2017-0009 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2017:2200-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11782 · Security Note