Information disclosure in Subversion - CVE-2021-28544

Vulnerability identifier: #VU62078

CSH Severity: Low

CVSS v4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-28544

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote user to gain access to potentially sensitive information.

The vulnerability exists due to exposure of the node "copyfrom" path copied from a protected location. A remote user can gain unauthorized access to sensitive information on the system.

Subversion
Amazon Linux AMI
SUSE CaaS Platform
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Enterprise Storage
macOS
SUSE Linux Enterprise Server
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Desktop
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Server Applications
openSUSE Leap
openEuler
Ubuntu
Fedora
subversion (Debian package)
libsvn_auth_gnome_keyring-1-0-debuginfo
subversion
subversion-debuginfo
subversion-debugsource
subversion-devel
subversion-perl
subversion-perl-debuginfo
subversion-python
subversion-python-debuginfo
subversion-server
subversion-server-debuginfo
subversion-tools
subversion-tools-debuginfo
subversion-bash-completion
libsvn_auth_gnome_keyring-1-0
subversion-ruby-debuginfo
subversion-ruby
libsvn_auth_kwallet-1-0-debuginfo
libsvn_auth_kwallet-1-0
subversion-python-ctypes
ruby-subversion
python3-subversion
perl-subversion
subversion-help
ruby-svn (Ubuntu package)
subversion-tools (Ubuntu package)
libapache2-mod-svn (Ubuntu package)
python-subversion (Ubuntu package)
libsvn-perl (Ubuntu package)
libsvn-java (Ubuntu package)
libsvn1 (Ubuntu package)
subversion (Ubuntu package)
python3-subversion (Ubuntu package)
IBM Tivoli Netcool Impact

Install updates from vendor's website.

Subversion - addressed in versions 1.10.8, 1.14.2
subversion (Debian package) - addressed in versions 1.10.4-1+deb10u3, 1.14.1-3+deb11u1
IBM Tivoli Netcool Impact - update to 7.1.0.26
macOS - update to 12.5 21G72
libsvn_auth_gnome_keyring-1-0-debuginfo - addressed in versions 1.10.6-3.6.1, 1.10.6-150300.10.8.1
subversion - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-debuginfo - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-debugsource - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-devel - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-perl - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-perl-debuginfo - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-python - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-python-debuginfo - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-server - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-server-debuginfo - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-tools - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-tools-debuginfo - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
subversion-bash-completion - addressed in versions 1.10.6-3.6.1, 1.10.6-150000.3.21.1, 1.10.6-150300.10.8.1
libsvn_auth_gnome_keyring-1-0 - addressed in versions 1.10.6-3.6.1, 1.10.6-150300.10.8.1
subversion-ruby-debuginfo - update to 1.10.6-150300.10.8.1
subversion-ruby - update to 1.10.6-150300.10.8.1
libsvn_auth_kwallet-1-0-debuginfo - update to 1.10.6-150300.10.8.1
libsvn_auth_kwallet-1-0 - update to 1.10.6-150300.10.8.1
subversion-python-ctypes - update to 1.10.6-150300.10.8.1
subversion-debugsource - update to 1.12.2-4
subversion-debuginfo - update to 1.12.2-4
ruby-subversion - update to 1.12.2-4
python3-subversion - update to 1.12.2-4
perl-subversion - update to 1.12.2-4
subversion - update to 1.12.2-4
subversion-devel - update to 1.12.2-4
subversion-help - update to 1.12.2-4
ruby-svn (Ubuntu package) - addressed in versions 1.13.0-3ubuntu0.1, 1.14.1-3ubuntu0.1
subversion-tools (Ubuntu package) - addressed in versions 1.13.0-3ubuntu0.1, 1.14.1-3ubuntu0.1
libapache2-mod-svn (Ubuntu package) - addressed in versions 1.13.0-3ubuntu0.1, 1.14.1-3ubuntu0.1, 1.14.1-3ubuntu0.22.04.1
python-subversion (Ubuntu package) - update to 1.13.0-3ubuntu0.1
libsvn-perl (Ubuntu package) - addressed in versions 1.13.0-3ubuntu0.1, 1.14.1-3ubuntu0.1
libsvn-java (Ubuntu package) - addressed in versions 1.13.0-3ubuntu0.1, 1.14.1-3ubuntu0.1
libsvn1 (Ubuntu package) - addressed in versions 1.13.0-3ubuntu0.1, 1.14.1-3ubuntu0.1, 1.14.1-3ubuntu0.22.04.1
subversion (Ubuntu package) - addressed in versions 1.13.0-3ubuntu0.1, 1.14.1-3ubuntu0.1, 1.14.1-3ubuntu0.22.04.1
python3-subversion (Ubuntu package) - update to 1.14.1-3ubuntu0.1
subversion - update to 1.14.2-5
subversion - addressed in versions 1.14.2-5.fc35, 1.14.2-5.fc36

• https://subversion.apache.org/security/CVE-2021-28544-advisory.txt

• Multiple vulnerabilities in Apache Subversion
• Ubuntu update for subversion
• Debian update for subversion
• Ubuntu update for subversion
• Information disclosure in IBM Tivoli Netcool Impact
• Multiple vulnerabilities in macOS Monterey
• SUSE update for subversion
• SUSE update for subversion
• SUSE update for subversion
• openEuler update for subversion
• Amazon Linux AMI update for subversion
• Fedora 35 update for subversion
• Fedora 36 update for subversion