PT-2017-8960 · Red Hat+1 · Red Hat+3

Adam Mariš · Published 2017-07-14 · Updated 2023-02-13 · CVE-2016-6312

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Subversion as packaged in Red Hat Enterprise Linux 5.11

Description The issue allows remote authenticated users with access to the webdav repository to cause a denial of service, resulting in memory consumption and httpd crash, due to improper detection of recursion during entity expansion in the mod dontdothat component of the mod dav svn Apache module.

Recommendations For Subversion as packaged in Red Hat Enterprise Linux 5.11, consider restricting access to the webdav repository to minimize the risk of exploitation until a patch is available.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2016-6312

Affected Products

Red Hat

Subversion

Httpd

Mod Dav Svn

References · 4

• https://osv.dev/vulnerability/CVE-2016-6312 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-6312 · Security Note
• http://securityfocus.com/bid/92320 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1364122 · Note