CVE-2016-8734 Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The at...
MediumCVSS 6.5
EPSS 6.4%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/subversion(Debian:12) | < 1.9.5-1 | 1.9.5-1 |
| debian/subversion(Debian:13) | < 1.9.5-1 | 1.9.5-1 |
| debian/subversion(Debian:14) | < 1.9.5-1 | 1.9.5-1 |
| apache subversion | = 1.4.0 | No fix listed |
| apache subversion | = 1.4.1 | No fix listed |
| apache subversion | = 1.4.2 | No fix listed |
| apache subversion | = 1.4.3 | No fix listed |
| apache subversion | = 1.4.4 | No fix listed |
| apache subversion | = 1.4.5 | No fix listed |
| apache subversion | = 1.4.6 | No fix listed |
| apache subversion | = 1.5.0 | No fix listed |
| apache subversion | = 1.5.1 | No fix listed |
| apache subversion | = 1.5.2 | No fix listed |
| apache subversion | = 1.5.3 | No fix listed |
| apache subversion | = 1.5.4 | No fix listed |
| apache subversion | = 1.5.5 | No fix listed |
| apache subversion | = 1.5.6 | No fix listed |
| apache subversion | = 1.5.7 | No fix listed |
| apache subversion | = 1.5.8 | No fix listed |
| apache subversion | = 1.6.0 | No fix listed |
| apache subversion | = 1.6.1 | No fix listed |
| apache subversion | = 1.6.2 | No fix listed |
| apache subversion | = 1.6.3 | No fix listed |
| apache subversion | = 1.6.4 | No fix listed |
| apache subversion | = 1.6.5 | No fix listed |
Show 64 more
| Product | Affected versions | Fixed in |
|---|---|---|
| apache subversion | = 1.6.6 | No fix listed |
| apache subversion | = 1.6.7 | No fix listed |
| apache subversion | = 1.6.8 | No fix listed |
| apache subversion | = 1.6.9 | No fix listed |
| apache subversion | = 1.6.10 | No fix listed |
| apache subversion | = 1.6.11 | No fix listed |
| apache subversion | = 1.6.12 | No fix listed |
| apache subversion | = 1.6.13 | No fix listed |
| apache subversion | = 1.6.14 | No fix listed |
| apache subversion | = 1.6.15 | No fix listed |
| apache subversion | = 1.6.16 | No fix listed |
| apache subversion | = 1.6.17 | No fix listed |
| apache subversion | = 1.6.18 | No fix listed |
| apache subversion | = 1.6.19 | No fix listed |
| apache subversion | = 1.6.20 | No fix listed |
| apache subversion | = 1.6.21 | No fix listed |
| apache subversion | = 1.6.23 | No fix listed |
| apache subversion | = 1.7.0 | No fix listed |
| apache subversion | = 1.7.1 | No fix listed |
| apache subversion | = 1.7.2 | No fix listed |
| apache subversion | = 1.7.3 | No fix listed |
| apache subversion | = 1.7.4 | No fix listed |
| apache subversion | = 1.7.5 | No fix listed |
| apache subversion | = 1.7.6 | No fix listed |
| apache subversion | = 1.7.7 | No fix listed |
| apache subversion | = 1.7.8 | No fix listed |
| apache subversion | = 1.7.9 | No fix listed |
| apache subversion | = 1.7.10 | No fix listed |
| apache subversion | = 1.7.11 | No fix listed |
| apache subversion | = 1.7.12 | No fix listed |
| apache subversion | = 1.7.13 | No fix listed |
| apache subversion | = 1.7.14 | No fix listed |
| apache subversion | = 1.7.15 | No fix listed |
| apache subversion | = 1.7.16 | No fix listed |
| apache subversion | = 1.7.17 | No fix listed |
| apache subversion | = 1.7.18 | No fix listed |
| apache subversion | = 1.7.19 | No fix listed |
| apache subversion | = 1.7.20 | No fix listed |
| apache subversion | = 1.8.0 | No fix listed |
| apache subversion | = 1.8.1 | No fix listed |
| apache subversion | = 1.8.2 | No fix listed |
| apache subversion | = 1.8.3 | No fix listed |
| apache subversion | = 1.8.4 | No fix listed |
| apache subversion | = 1.8.5 | No fix listed |
| apache subversion | = 1.8.6 | No fix listed |
| apache subversion | = 1.8.7 | No fix listed |
| apache subversion | = 1.8.8 | No fix listed |
| apache subversion | = 1.8.9 | No fix listed |
| apache subversion | = 1.8.10 | No fix listed |
| apache subversion | = 1.8.11 | No fix listed |
| apache subversion | = 1.8.12 | No fix listed |
| apache subversion | = 1.8.13 | No fix listed |
| apache subversion | = 1.8.14 | No fix listed |
| apache subversion | = 1.8.15 | No fix listed |
| apache subversion | = 1.8.16 | No fix listed |
| apache subversion | = 1.9.0 | No fix listed |
| apache subversion | = 1.9.1 | No fix listed |
| apache subversion | = 1.9.2 | No fix listed |
| apache subversion | = 1.9.3 | No fix listed |
| apache subversion | = 1.9.4 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| debian linux | = 9.0 | No fix listed |
| Apache Subversion | = 1.4.0 to 1.8.16 | No fix listed |
| Apache Subversion | = 1.9.0 to 1.9.4 | No fix listed |
References
- Debian Security Tracker CVE-2016-8734 vendor-advisory
- DSA-3932 third-party-advisory vendor-advisory
- 94588 third-party-advisory vdb-entry
- 1037361 third-party-advisory vdb-entry
- [announce] 20161129 [SECURITY] Apache Subversion 1.9.5 released mailing-list
- subversion.apache.org issue-tracking vendor-advisory
- www.oracle.com