Input validation error in Subversion - CVE-2024-46901

Vulnerability identifier: #VU101363

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-46901

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of filenames if serving repositories via mod_dav_svn. A remote attacker can pass specially crafted filename to the application and perform a denial of service (DoS) attack.

Subversion
SUSE Linux Enterprise Server 12 SP5 LTSS Extended
SUSE Linux Enterprise Server for SAP Applications 12
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Desktop 15
Server Applications Module
Development Tools Module
Basesystem Module
openSUSE Leap
Ubuntu
openEuler
Anolis OS
Fedora
Communications Unified Assurance
subversion (Ubuntu package)
subversion-devel
subversion
subversion-help
subversion-debuginfo
ruby-subversion
perl-subversion
python2-subversion
subversion-debugsource
subversion-server-debuginfo
subversion-bash-completion
libsvn_auth_gnome_keyring-1-0-debuginfo
subversion-ruby
subversion-tools
libsvn_auth_kwallet-1-0
subversion-perl-debuginfo
subversion-python-debuginfo
subversion-tools-debuginfo
libsvn_auth_kwallet-1-0-debuginfo
subversion-python
subversion-perl
subversion-server
libsvn_auth_gnome_keyring-1-0
subversion-ruby-debuginfo
subversion-javahl
subversion-libs
subversion-gnome
python3-subversion
mod_dav_svn

Install updates from vendor's website.

Subversion - update to 1.14.5
subversion (Ubuntu package) - addressed in versions 1.9.3-2ubuntu1.3+esm2, 1.9.7-4ubuntu1.1+esm1, 1.13.0-3ubuntu0.2+esm2, 1.14.1-3ubuntu0.22.04.1+esm1, 1.14.3-1ubuntu0.1~esm1
subversion-devel - addressed in versions 1.10.6-3.9.1, 1.14.1-150400.5.3.1
subversion - update to 1.12.2-8
subversion-help - update to 1.12.2-8
subversion-devel - update to 1.12.2-8
subversion-debuginfo - update to 1.12.2-8
ruby-subversion - update to 1.12.2-8
perl-subversion - update to 1.12.2-8
python2-subversion - update to 1.12.2-8
subversion-debugsource - update to 1.12.2-8
subversion-server-debuginfo - update to 1.14.1-150400.5.3.1
subversion-bash-completion - update to 1.14.1-150400.5.3.1
libsvn_auth_gnome_keyring-1-0-debuginfo - update to 1.14.1-150400.5.3.1
subversion-debuginfo - update to 1.14.1-150400.5.3.1
subversion - update to 1.14.1-150400.5.3.1
subversion-ruby - update to 1.14.1-150400.5.3.1
subversion-tools - update to 1.14.1-150400.5.3.1
libsvn_auth_kwallet-1-0 - update to 1.14.1-150400.5.3.1
subversion-perl-debuginfo - update to 1.14.1-150400.5.3.1
subversion-python-debuginfo - update to 1.14.1-150400.5.3.1
subversion-tools-debuginfo - update to 1.14.1-150400.5.3.1
libsvn_auth_kwallet-1-0-debuginfo - update to 1.14.1-150400.5.3.1
subversion-python - update to 1.14.1-150400.5.3.1
subversion-perl - update to 1.14.1-150400.5.3.1
subversion-server - update to 1.14.1-150400.5.3.1
libsvn_auth_gnome_keyring-1-0 - update to 1.14.1-150400.5.3.1
subversion-debugsource - update to 1.14.1-150400.5.3.1
subversion-ruby-debuginfo - update to 1.14.1-150400.5.3.1
subversion-devel - update to 1.14.5-1
subversion-javahl - update to 1.14.5-1
subversion-tools - update to 1.14.5-1
subversion-ruby - update to 1.14.5-1
subversion-perl - update to 1.14.5-1
subversion-libs - update to 1.14.5-1
subversion-gnome - update to 1.14.5-1
subversion - update to 1.14.5-1
python3-subversion - update to 1.14.5-1
mod_dav_svn - update to 1.14.5-1
subversion - update to 1.14.5-1.fc41

• https://subversion.apache.org/security/CVE-2024-46901-advisory.txt

• Remote denial of service in Apache Subversion
• Fedora 41 update for subversion
• openEuler update for subversion
• SUSE update for subversion
• SUSE update for subversion
• Anolis OS update for subversion
• Ubuntu update for subversion
• Ubuntu update for subversion
• Multiple vulnerabilities in Communications Unified Assurance