This update includes the latest stable release of _Apache Subversion_, version **1.9.7**.

#### Client-side bugfixes :

  - Fix arbitrary code execution vulnerability CVE-2017-9800     See     <https://subversion.apache.org/security/CVE-2017-9800-ad     visory.txt> for details.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Command injection through clients via malicious svn+ssh URLs

A shell command injection flaw related to the handling of 'svn+ssh' URLs has been discovered in Subversion. An attacker could use this flaw to execute shell commands with the privileges of the user running the Subversion client, for example when performing a 'checkout' or 'update' action on a malicious repository, or a legitimate repository containing a malicious commit. (CVE-2017-9800)

The version of Apple Xcode installed on the remote macOS or Mac OS X host is prior to 9.0. It is, therefore, affected by multiple remote code execution vulnerabilities in the git, Id64, and subversion components. An unauthenticated, remote attacker can exploit these vulnerabilities to cause execution of arbitrary code.

An update of [subversion] packages for PhotonOS has been released.

已发现 subversion 版本控制系统中存在一个任意代码执行漏洞，可通过“svn:externals”和“svn:sync-from-url”中的恶意“svn+ssh”URL 利用。对于 Debian 7“Wheezy”，已在 subversion 版本 1.6.17dfsg-4+deb7u12 中修复此问题。我们建议您升级 subversion 程序包。注意：Tenable Network Security 已直接从 DLA 安全公告中提取上述描述块。Tenable 已尝试在不引入其他问题的情况下，尽可能进行自动整理和排版。

安全修复：- Subversion 中发现与 ‘svn+ssh’ URL 处理有关的 shell 命令注入缺陷。攻击者可利用此缺陷，以 Subversion 客户端运行用户的权限执行 shell 命令，例如，在恶意存储库或者含恶意提交的合法存储库中执行“检出”或“更新”操作。(CVE-2017-9800)

通过恶意 svn+ssh URL，在客户端中注入命令。在 Subversion 中发现与处理 'svn+ssh' URL 相关的 shell 命令注入缺陷。攻击者可利用此缺陷，以 Subversion 客户端运行用户的权限执行 shell 命令，例如，在恶意存储库或者含恶意提交的合法存储库中执行“检出”或“更新”操作。(CVE-2017-9800)

远程 macOS 或 Mac OS X 主机上安装的 Apple Xcode 版本低于 9.0。因而会受到 git、Id64 和 subversion 组件中多个远程代码执行漏洞的影响。未经身份验证的远程攻击者可利用这些漏洞导致执行任意代码。

ID	名稱	產品	系列	已發布	已更新	嚴重性
102716	Fedora 25 : subversion (2017-1d1a38bdd1)	Nessus	Fedora Local Security Checks	2017/8/24	2021/1/11	critical
102871	Amazon Linux AMI : subversion / mod_dav_svn (ALAS-2017-883)	Nessus	Amazon Linux Local Security Checks	2017/9/1	2018/4/18	critical
103359	Apple Xcode < 9.0 Multiple RCE (macOS)	Nessus	MacOS X Local Security Checks	2017/9/20	2020/5/5	critical
111880	Photon OS 1.0: Subversion PHSA-2017-0031 (deprecated)	Nessus	PhotonOS Local Security Checks	2018/8/17	2019/2/7	critical
102437	Debian DLA-1052-1：子版本安全更新	Nessus	Debian Local Security Checks	2017/8/14	2021/1/11	critical
102673	Scientific Linux 安全更新：SL7.x（x86_64）中的 subversion	Nessus	Scientific Linux Local Security Checks	2017/8/22	2021/1/14	critical
102871	Amazon Linux AMI：subversion / mod_dav_svn (ALAS-2017-883)	Nessus	Amazon Linux Local Security Checks	2017/9/1	2018/4/18	critical
103359	Apple Xcode < 9.0 多个 RCE (macOS)	Nessus	MacOS X Local Security Checks	2017/9/20	2020/5/5	critical

偵測

搜尋 Plugin

critical

critical

critical

critical

critical

critical

critical

critical