CVE-2017-9800 A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be gen...
CriticalCVSS 9.8
EPSS 18.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/subversion(Debian:12) | < 1.9.7-1 | 1.9.7-1 |
| debian/subversion(Debian:13) | < 1.9.7-1 | 1.9.7-1 |
| debian/subversion(Debian:14) | < 1.9.7-1 | 1.9.7-1 |
| apache subversion | <= 1.8.18 | No fix listed |
| apache subversion | = 1.9.0 | No fix listed |
| apache subversion | = 1.9.1 | No fix listed |
| apache subversion | = 1.9.2 | No fix listed |
| apache subversion | = 1.9.3 | No fix listed |
| apache subversion | = 1.9.4 | No fix listed |
| apache subversion | = 1.9.5 | No fix listed |
| apache subversion | = 1.9.6 | No fix listed |
| apache subversion | = 1.10.0 | No fix listed |
| apache subversion | = 1.10.0-alpha1 | No fix listed |
| apache subversion | = 1.10.0-alpha2 | No fix listed |
| apache subversion | = 1.10.0-alpha3 | No fix listed |
| alpine/subversion(Alpine:v3.10) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.11) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.12) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.13) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.14) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.15) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.16) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.17) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.18) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.19) | < 1.9.7-r0 | 1.9.7-r0 |
Show 14 more
| Product | Affected versions | Fixed in |
|---|---|---|
| alpine/subversion(Alpine:v3.20) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.21) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.22) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.23) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.24) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.3) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.4) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.5) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.6) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.7) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.8) | < 1.9.7-r0 | 1.9.7-r0 |
| alpine/subversion(Alpine:v3.9) | < 1.9.7-r0 | 1.9.7-r0 |
| Apache Subversion | = 1.0.0 to 1.8.18 | No fix listed |
| Apache Subversion | = 1.9.0 to 1.9.6 | No fix listed |
References
- Debian Security Tracker CVE-2017-9800 vendor-advisory
- packetstormsecurity.com
- DSA-3932 vendor-advisory
- 20170810 [SECURITY][ANNOUNCE] Apache Subversion 1.9.7 released mailing-list
- 100259 third-party-advisory vdb-entry
- 1039127 third-party-advisory vdb-entry
- RHSA-2017:2480 vendor-advisory
- confluence.atlassian.com
- [announce] 20170810 [SECURITY][ANNOUNCE] Apache Subversion 1.9.7 released mailing-list
- [subversion-commits] 20190830 svn commit: r1866117 - in /subversion/site/publish/docs/community-guide: how-to-roll-releases-in-private.txt issues.part.html mailing-list
- GLSA-201709-09 vendor-advisory
- subversion.apache.org vendor-advisory
- support.apple.com
- www.oracle.com
- security.alpinelinux.org vendor-advisory