Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7

An update of the subversion package has been released.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:0507 advisory.

  - Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the     AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL.
    This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn     servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7 (CVE-2020-17525)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5445-1 advisory.

    Ace Olszowka discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker     could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue     only affected Ubuntu 18.04 LTS. (CVE-2018-11782)

    Tomas Bortoli discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker     could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue     only affected Ubuntu 18.04 LTS. (CVE-2019-0203)

    Thomas kesson discovered that Subversion incorrectly handled certain inputs. An attacker could possibly     use this issue to cause a denial of service. (CVE-2020-17525)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 ESM host has packages installed that are affected by a vulnerability as referenced in the USN-5322-1 advisory.

    Thomas Akesson discovered that Subversion incorrectly handled certain inputs. An attacker could possibly     use this issue to cause a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - A null-pointer-dereference flaw was found in     mod_authz_svn of subversion. This flaw allows a remote,     unauthenticated attacker to cause a denial of service     in some server configurations. The highest threat from     this vulnerability is to system     availability.(CVE-2020-17525)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

One security issue has been discovered in subversion :

CVE-2020-17525 :

Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL.
This can lead to disruption for users of the service.

For Debian 9 stretch, this problem has been fixed in version 1.9.5-1+deb9u6.

We recommend that you upgrade your subversion packages.

For the detailed security status of subversion please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/subversion

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of subversion installed on the remote host is prior to 1.9.7-1.61. It is, therefore, affected by a vulnerability as referenced in the ALAS-2021-1483 advisory. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 32 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-16e51e39a6 advisory.

  - Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the     AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL.
    This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn     servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7 (CVE-2020-17525)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2021-0507 advisory.

    subversion     [1.10.2-4]
    - add security fix for CVE-2020-17525

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Thomas Akesson discovered a remotely triggerable vulnerability in the mod_authz_svn module in Subversion, a version control system. When using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option an unauthenticated remote client can take advantage of this flaw to cause a denial of service by sending a request for a non-existing repository URL.

This update for subversion fixes the following issues :

  - CVE-2020-17525: A null-pointer-dereference has been     found in mod_authz_svn that results in a remote     unauthenticated Denial-of-Service in some server     configurations (bsc#1181687).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0509 advisory.

    Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in     developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

    Security Fix(es):

    * subversion: Remote unauthenticated denial of service in mod_authz_svn (CVE-2020-17525)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0507 advisory.

    Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in     developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

    Security Fix(es):

    * subversion: Remote unauthenticated denial of service in mod_authz_svn (CVE-2020-17525)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:0508 advisory.

    Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in     developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

    Security Fix(es):

    * subversion: Remote unauthenticated denial of service in mod_authz_svn (CVE-2020-17525)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2021:0507 advisory.

  - subversion: Remote unauthenticated denial of service in mod_authz_svn (CVE-2020-17525)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 33 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2021-a3a0273cb2 advisory.

  - Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the     AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL.
    This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn     servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7 (CVE-2020-17525)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for subversion fixes the following issues :

CVE-2020-17525: A null-pointer-dereference has been found in mod_authz_svn that results in a remote unauthenticated Denial-of-Service in some server configurations (bsc#1181687).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
204351	Photon OS 4.0: Subversion PHSA-2021-4.0-0008	Nessus	PhotonOS Local Security Checks	high
184826	Rocky Linux 8 : subversion:1.10 (RLSA-2021:0507)	Nessus	Rocky Linux Local Security Checks	high
161576	Ubuntu 18.04 LTS / 20.04 LTS : Subversion vulnerabilities (USN-5445-1)	Nessus	Ubuntu Local Security Checks	high
158866	Ubuntu 16.04 ESM : Subversion vulnerability (USN-5322-1)	Nessus	Ubuntu Local Security Checks	high
150217	EulerOS 2.0 SP9 : subversion (EulerOS-SA-2021-1938)	Nessus	Huawei Local Security Checks	high
150199	EulerOS 2.0 SP9 : subversion (EulerOS-SA-2021-1959)	Nessus	Huawei Local Security Checks	high
149626	EulerOS 2.0 SP8 : subversion (EulerOS-SA-2021-1890)	Nessus	Huawei Local Security Checks	high
149246	Debian DLA-2646-1 : subversion security update	Nessus	Debian Local Security Checks	high
148818	Photon OS 1.0: Subversion PHSA-2021-1.0-0379	Nessus	PhotonOS Local Security Checks	high
148291	Photon OS 3.0: Subversion PHSA-2021-3.0-0213	Nessus	PhotonOS Local Security Checks	high
148287	Photon OS 2.0: Subversion PHSA-2021-2.0-0333	Nessus	PhotonOS Local Security Checks	high
146814	Amazon Linux AMI : subversion (ALAS-2021-1483)	Nessus	Amazon Linux Local Security Checks	high
146718	Fedora 32 : subversion (2021-16e51e39a6)	Nessus	Fedora Local Security Checks	high
146639	Oracle Linux 8 : subversion:1.10 (ELSA-2021-0507)	Nessus	Oracle Linux Local Security Checks	high
146514	Debian DSA-4851-1 : subversion - security update	Nessus	Debian Local Security Checks	high
146508	openSUSE Security Update : subversion (openSUSE-2021-280)	Nessus	SuSE Local Security Checks	high
146493	RHEL 8 : subversion:1.10 (RHSA-2021:0509)	Nessus	Red Hat Local Security Checks	high
146492	RHEL 8 : subversion:1.10 (RHSA-2021:0507)	Nessus	Red Hat Local Security Checks	high
146491	RHEL 8 : subversion:1.10 (RHSA-2021:0508)	Nessus	Red Hat Local Security Checks	high
146490	CentOS 8 : subversion:1.10 (CESA-2021:0507)	Nessus	CentOS Local Security Checks	high
146467	Fedora 33 : subversion (2021-a3a0273cb2)	Nessus	Fedora Local Security Checks	high
146394	SUSE SLED15 / SLES15 Security Update : subversion (SUSE-SU-2021:0425-1)	Nessus	SuSE Local Security Checks	high

Detections

Analytics

CVE-2020-17525

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high

high