Resource exhaustion in subversion (Alpine package)

1) Resource exhaustion

EUVDB-ID: #VU33570

Risk: Medium

CVSSv4.0: 4.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2016-8734

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.

Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.

Mitigation

Install update from vendor's website.

Vulnerable software versions

subversion (Alpine package): 1.8.16-r0

CPE2.3

• cpe:2.3:a:alpine:subversion_alpine_package:1.8.16-r0:*:*:*:*:alpine_linux:*:3.1

External links

https://git.alpinelinux.org/aports/commit/?id=b8487132638ccfbb441733164ca93ab03643ab6a
https://git.alpinelinux.org/aports/commit/?id=93f807e241592a5964f8d3ce00936a2df782606c

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.