Input validation error in Subversion - CVE-2018-11803
Published: January 25, 2019
Vulnerability identifier: #VU17221
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2018-11803
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input when processing recursive directory listing operations. A remote authenticated attacker can omit the root path, trigger the mod_dav_svn to deference an uninitialized pointer variable and, as a result, crash the HTTPD worker process handling the request.
Affected software
Subversion
Arch Linux
Gentoo Linux
Opensuse
Fedora
subversion (Alpine package)
subversion (Ubuntu package)
subversion
Arch Linux
Gentoo Linux
Opensuse
Fedora
subversion (Alpine package)
subversion (Ubuntu package)
subversion
How to mitigate CVE-2018-11803
Install updates from vendor's website.
Subversion - update to 1.10.4
subversion (Alpine package) - update to 1.10.4-r0
subversion (Ubuntu package) - update to 1.10.0-2ubuntu2.1
subversion - update to 1.11.1-1.fc28
subversion (Alpine package) - update to 1.10.4-r0
subversion (Ubuntu package) - update to 1.10.0-2ubuntu2.1
subversion - update to 1.11.1-1.fc28