Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2018-11782     Ace Olszowka reported that the Subversion's svnserve     server process may exit when a well-formed read-only     request produces a particular answer, leading to a     denial of service.

  - CVE-2019-0203     Tomas Bortoli reported that the Subversion's svnserve     server process may exit when a client sends certain     sequences of protocol commands. If the server is     configured with anonymous access enabled this could lead     to a remote unauthenticated denial of service.

This update for subversion to version 1.10.6 fixes the following issues :

Security issues fixed :

  - CVE-2018-11782: Fixed a remote denial of service in     svnserve 'get-deleted-rev' (bsc#1142743).

  - CVE-2019-0203: Fixed a remote, unauthenticated denial of     service in svnserve (bsc#1142721).

This update was imported from the SUSE:SLE-15:Update update project.

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.(CVE-2018-11782)

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.(CVE-2019-0203)

The installed version of Subversion Server is prior to 1.9.11, 1.10.x prior to 1.10.5, 1.11.x or 1.12.x prior to 1.12.1 and is, therefore, affected by multiple vulnerabilities:

 - A denial of service (DoS) vulnerability exists in Subversion's svnserve server process due to that the process may exit    when a well-formed read-only request produces a particular answer. A remote authenticated attacker can exploit this issue    to cause a denial of service attack. (CVE-2018-11782)

 - A denial of service (DoS) vulnerability exists in Subversion's svnserve server process due to that the process may exit    when a client sends certain sequences of protocol commands. A remote unauthenticated attacker can exploit this issue,    If the server is configured with anonymous access enabled, to cause a remote denial of service attack. (CVE-2019-0203)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2021:0018 advisory.

    Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities:

    CVE-2019-0203:
    In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a client sends certain sequences of protocol commands. This can lead to disruption     for users of the server.

    CVE-2020-17525:
    Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the     AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL.
    This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn     servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7

Tenable has extracted the preceding description block directly from the Alibaba Cloud Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for subversion to version 1.10.6 fixes the following issues :

Security issues fixed :

CVE-2018-11782: Fixed a remote denial of service in svnserve 'get-deleted-rev' (bsc#1142743).

CVE-2019-0203: Fixed a remote, unauthenticated denial of service in svnserve (bsc#1142721).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5445-1 advisory.

    Ace Olszowka discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker     could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue     only affected Ubuntu 18.04 LTS. (CVE-2018-11782)

    Tomas Bortoli discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker     could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue     only affected Ubuntu 18.04 LTS. (CVE-2019-0203)

    Thomas kesson discovered that Subversion incorrectly handled certain inputs. An attacker could possibly     use this issue to cause a denial of service. (CVE-2020-17525)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名稱	產品	系列	已發布	已更新	嚴重性
127486	Debian DSA-4490-1 : subversion - security update	Nessus	Debian Local Security Checks	2019/8/12	2024/5/7	high
128002	openSUSE Security Update : subversion (openSUSE-2019-1910)	Nessus	SuSE Local Security Checks	2019/8/20	2024/5/2	high
130610	Amazon Linux AMI : subversion (ALAS-2019-1317)	Nessus	Amazon Linux Local Security Checks	2019/11/7	2024/4/15	high
127137	Apache Subversion < 1.9.11 / 1.10.x < 1.10.5 / 1.11.x / 1.12.x < 1.12.1 Multiple Vulnerabilities	Nessus	Windows	2019/8/12	2021/6/3	high
236667	Alibaba Cloud Linux 3 : 0018: subversion:1.10 (ALINUX3-SA-2021:0018)	Nessus	Alibaba Cloud Linux Local Security Checks	2025/5/14	2025/5/14	high
127760	SUSE SLED15 / SLES15 Security Update : subversion (SUSE-SU-2019:2031-1)	Nessus	SuSE Local Security Checks	2019/8/12	2024/5/6	high
161576	Ubuntu 18.04 LTS / 20.04 LTS : Subversion vulnerabilities (USN-5445-1)	Nessus	Ubuntu Local Security Checks	2022/5/26	2025/9/3	high

偵測

搜尋 Plugin

high

high

high

high

high

high

high