Resource exhaustion - CVE-2016-8734
Published: October 16, 2017 / Updated: August 4, 2020
Vulnerability identifier: #VU33570
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2016-8734
CWE-ID: CWE-400
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to perform a denial of service (DoS) attack.
Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory.
Affected software
Amazon Linux AMI
Fedora
subversion (Alpine package)
subversion
Fedora
subversion (Alpine package)
subversion
How to mitigate CVE-2016-8734
Install update from vendor's website.
subversion (Alpine package) - update to 1.8.17-r0
subversion - update to 1.9.5-1.fc25
subversion - update to 1.9.5-1.fc25
External References
- http://www.debian.org/security/2017/dsa-3932
- http://www.securityfocus.com/bid/94588
- http://www.securitytracker.com/id/1037361
- https://lists.apache.org/thread.html/7798f5cda1b2a3c70db4be77694b12dec8fcc1a441b00009d44f0e09@%3Cannounce.apache.org%3E
- https://subversion.apache.org/security/CVE-2016-8734-advisory.txt