OS command injection in Subversion - CVE-2017-9800

Vulnerability identifier: #VU7886

CSH Severity: High

CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-9800

CWE-ID: CWE-78

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary shell commands on the target system.

The weakness exists due to command injection flaw. A remote attacker (e.g., repository, proxy server) can return a specially crafted 'svn+ssh://' URL during 'checkout', 'export', 'update', and 'switch' commands and execute arbitrary shell commands with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Subversion
Arch Linux
Gentoo Linux
Amazon Linux AMI
Red Hat Enterprise Linux for x86_64
Slackware Linux
Fedora
subversion (Alpine package)
subversion
Oracle Data Integrator

Update to version 1.8.19 or 1.9.7.

subversion (Alpine package) - update to 1.9.7-r0
subversion - addressed in versions 1.9.7-1.fc25, 1.9.7-1.fc26

• http://subversion.apache.org/security/CVE-2017-9800-advisory.txt

• Command execution in Apache Subversion
• Slackware Linux update for subversion
• Red Hat update for supervision
• Arch Linux update for subversion
• Gentoo update for Subversion
• Amazon Linux AMI update for subversion, mod_dav_svn
• OS command injection in subversion (Alpine package)
• Arch Linux update for mercurial
• Multiple vulnerabilities in Oracle Data Integrator
• Fedora 25 update for subversion
• Fedora 26 update for subversion