此更新含有 Apache Subversion 1.8 版的最新穩定版本 **1.8.15**。此更新修正了兩個安全性問題：*
**CVE-2015-3184**：使用 Apache httpd 2.4 時，Subversion 的 mod_authz_svn 未正確限制某些混合匿名/驗證環境中的匿名存取。
http://subversion.apache.org/security/CVE-2015-3184-advisory.txt *
**CVE-2015-3187**：Subversion 伺服器 (httpd 及 svnserve) 會洩漏某些應由路徑型 authz 隱藏的路徑。
http://subversion.apache.org/security/CVE-2015-3187-advisory.txt ### 使用者可見的變更：#### 用戶端錯誤修正：* gpg-agent：修正非正式 $HOME * 文件 svn:autoprops 的損毀 * cp：修正「svn cp ^/A/D/H at 1 ^/A」以正確建立 A * 解決：改善二進位檔案的衝突提示 * ls：改善標籤目錄上的「-v」效能 * 改善外部的 Sqlite 3.8.9 查詢效能迴歸 * 修正 [問題 4580](http://subversion.tigris.org/issues/show_bug.cgi?id=4580)：檔案外部的「svn
-v st」在「svn up」之後是報告「?」而非使用者和修訂 #### 用戶端和伺服器端錯誤修正：* 修正舊樣式文字差的分割錯誤 #### 伺服器端錯誤修正：* fsfs：
減少 Apache 的記憶體配置* mod_dav_svn：盡快發出第一個記錄項目 * mod_dav_svn：針對 skel 編碼的要求使用 LimitXMLRequestBody * mod_dav_svn：不忽略 skel 剖析錯誤
* 提早偵測無效的 svndiff 資料 * 防止電源/磁碟失敗時可能發生的存放庫損毀 * 修正 [問題 4577](http://subversion.tigris.org/issues/show_bug.cgi?id=4577)：DELTA 鏈結以 PLAIN rep 起始的節點讀取錯誤* 修正 [問題 4531](http://subversion.tigris.org/issues/show_bug.cgi?id=4531)：
伺服器端複製 (透過 dav) 速度緩慢且使用過多記憶體 #### 繫結錯誤修正：* swig：修正 svn_client_copy_source_t 中的記憶體損毀 ### 開發人員可見的變更：#### 一般：
* 避免具有極舊 sqlite 的 Python 版本在部分測試中失敗 * 修正 Ruby 測試，避免其使用使用者的實際組態 #### 繫結：* swig-pl：修正部分堆疊記憶體問題

請注意，Tenable Network Security 已直接從 Fedora 安全性公告擷取前置描述區塊。Tenable 已盡量在不造成其他問題的前提下，嘗試自動清理並將其格式化。

遠端主機受到 GLSA-201610-05 中所述的弱點影響 (Subversion、Serf：多個弱點)

    在 Subversion 與 Serf 中發現多個弱點。
      如需詳細資訊，請檢閱下方提及的 CVE 識別碼 影響：

    遠端攻擊者可能會以處理程序的權限執行任意程式碼、發動攔截式攻擊、取得敏感資訊，或是造成拒絕服務情形。
  因應措施：

    目前尚無已知的因應措施。

The version of Apache Subversion installed on the remote host is 1.7.x prior to 1.7.21, or 1.8.x prior to 1.8.14 and is affected by the following vulnerabilities :

 - A security bypass flaw affects the 'mod_authz_svn' module as it does not properly restrict anonymous access in some mixed anonymous/authenticated environments when using Subversion with Apache httpd 2.4. (CVE-2015-3184) 
 - An information disclosure flaw affects 'authz'. Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz controls. (CVE-2015-3187)

The version of Apache HTTP Server 2.4 installed on the remote host is prior to 2.4.13. It is, therefore, affected by the following vulnerabilities : 

 - A flaw exists in the lua_websocket_read() function in the 'mod_lua' module due to incorrect handling of WebSocket PING frames. A remote attacker can exploit this, by sending a crafted WebSocket PING frame after a Lua script has called the wsupgrade() function, to crash a child process, resulting in a denial of service condition. (CVE-2015-0228) 
 - A NULL pointer dereference flaw exists in the read_request_line() function due to a failure to initialize the protocol structure member. A remote  attacker can exploit this flaw, on installations that enable the INCLUDES filter and has an ErrorDocument 400 directive specifying a local URI, by sending a request that lacks a method, to cause a denial of service condition. (CVE-2015-0253) 
 - A flaw exists in the chunked transfer coding implementation due to a failure to properly parse chunk headers. A remote attacker can exploit this to conduct HTTP request smuggling attacks. (CVE-2015-3183) 
 - A security bypass flaw affects mod_authz_svn related to a failure to properly restrict anonymous access. This may allow anonymous access in scenarios where it is intended to be restricted to authenticated users. (CVE-2015-3184) 
 - A flaw exists in the ap_some_auth_required() function due to a failure to consider that a Require directive may be associated with an authorization setting rather than an authentication setting. A remote attacker can exploit this, if a module that relies on the 2.2 API behavior exists, to bypass intended access restrictions. (CVE-2015-3185) 
 - A flaw exists in the RC4 algorithm due to an initial double-byte bias in the keystream generation. An attacker can exploit this, via Bayesian analysis that combines a priori plaintext distribution with keystream distribution statistics, to conduct a plaintext recovery of the ciphertext. Note that RC4 cipher suites are now prohibited per RFC 7465. This issue was fixed in Apache version 2.4.13; however, 2.4.13, 2.4.14, and 2.4.15 were never publicly released. (CVE-2015-2808)

ID	名稱	產品	系列	已發布	已更新	嚴重性
89276	Fedora 22︰subversion-1.8.15-1.fc22 (2015-6efa349a85)	Nessus	Fedora Local Security Checks	2016/3/4	2021/1/11	high
93992	GLSA-201610-05：Subversion、Serf：多個弱點	Nessus	Gentoo Local Security Checks	2016/10/12	2021/1/11	high
8973	Apache Subversion 1.7.x < 1.7.21 / 1.8.x < 1.8.14 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2015/10/13	2019/3/6	medium
8970	Apache HTTP Server 2.4.x < 2.4.16 Multiple Vulnerabilities	Nessus Network Monitor	Web Servers	2015/10/9	2019/3/6	medium

偵測

搜尋 Plugin

high

high

medium

medium