CVE-2013-4558 The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversion...
LowCVSS 3.5
EPSS 5.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/subversion(Debian:12) | < 1.7.14-1 | 1.7.14-1 |
| debian/subversion(Debian:13) | < 1.7.14-1 | 1.7.14-1 |
| debian/subversion(Debian:14) | < 1.7.14-1 | 1.7.14-1 |
| apache mod dav svn | All versions | No fix listed |
| apache subversion | = 1.7.11 | No fix listed |
| apache subversion | = 1.7.12 | No fix listed |
| apache subversion | = 1.7.13 | No fix listed |
| apache subversion | = 1.8.1 | No fix listed |
| apache subversion | = 1.8.2 | No fix listed |
| apache subversion | = 1.8.3 | No fix listed |
| apache subversion | = 1.8.4 | No fix listed |
References
- Debian Security Tracker CVE-2013-4558 vendor-advisory
- openSUSE-SU-2013:1836 vendor-advisory
- openSUSE-SU-2013:1860 vendor-advisory
- 100363 vdb-entry
- subversion.apache.org patch vendor-advisory
- bugzilla.redhat.com
- github.com
- github.com