SUSE update for subversion

Published: 2022-05-02

Risk	Medium
Patch available	YES
Number of vulnerabilities	2
CVE-ID	CVE-2021-28544 CVE-2022-24070
CWE-ID	CWE-200 CWE-416
Exploitation vector	Network
Public exploit	N/A
Vulnerable software Subscribe	SUSE Linux Enterprise Software Development Kit Operating systems & Components / Operating system SUSE Linux Enterprise Server for SAP Applications Operating systems & Components / Operating system SUSE Linux Enterprise Server Operating systems & Components / Operating system subversion-bash-completion Operating systems & Components / Operating system package or component subversion-tools-debuginfo Operating systems & Components / Operating system package or component subversion-tools Operating systems & Components / Operating system package or component subversion-server-debuginfo Operating systems & Components / Operating system package or component subversion-server Operating systems & Components / Operating system package or component subversion-python-debuginfo Operating systems & Components / Operating system package or component subversion-python Operating systems & Components / Operating system package or component subversion-perl-debuginfo Operating systems & Components / Operating system package or component subversion-perl Operating systems & Components / Operating system package or component subversion-devel Operating systems & Components / Operating system package or component subversion-debugsource Operating systems & Components / Operating system package or component subversion-debuginfo Operating systems & Components / Operating system package or component subversion Operating systems & Components / Operating system package or component libsvn_auth_gnome_keyring-1-0-debuginfo Operating systems & Components / Operating system package or component libsvn_auth_gnome_keyring-1-0 Operating systems & Components / Operating system package or component
Vendor	SUSE

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Information disclosure

EUVDB-ID: #VU62078

Risk: Low

CVSSv3.1: 3.8 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N/E:U/RL:O/RC:C]

CVE-ID: CVE-2021-28544

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to exposure of the node "copyfrom" path copied from a protected location. A remote user can gain unauthorized access to sensitive information on the system.

Mitigation

Update the affected package subversion to the latest version.

Vulnerable software versions

SUSE Linux Enterprise Software Development Kit: 12-SP5

SUSE Linux Enterprise Server for SAP Applications: 12-SP5

SUSE Linux Enterprise Server: 12-SP5

subversion-bash-completion: before 1.10.6-3.6.1

subversion-tools-debuginfo: before 1.10.6-3.6.1

subversion-tools: before 1.10.6-3.6.1

subversion-server-debuginfo: before 1.10.6-3.6.1

subversion-server: before 1.10.6-3.6.1

subversion-python-debuginfo: before 1.10.6-3.6.1

subversion-python: before 1.10.6-3.6.1

subversion-perl-debuginfo: before 1.10.6-3.6.1

subversion-perl: before 1.10.6-3.6.1

subversion-devel: before 1.10.6-3.6.1

subversion-debugsource: before 1.10.6-3.6.1

subversion-debuginfo: before 1.10.6-3.6.1

subversion: before 1.10.6-3.6.1

libsvn_auth_gnome_keyring-1-0-debuginfo: before 1.10.6-3.6.1

libsvn_auth_gnome_keyring-1-0: before 1.10.6-3.6.1

External links

http://www.suse.com/support/update/announcement/2022/suse-su-20221483-1/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Use-after-free

EUVDB-ID: #VU62079

Risk: Medium

CVSSv3.1: 6.5 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2022-24070

CWE-ID: CWE-416 - Use After Free