BIT-subversion-2022-24070
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/subversion/BIT-subversion-2022-24070.json
- JSON Data
- https://api.osv.dev/v1/vulns/BIT-subversion-2022-24070
- Aliases
- Published
- 2024-03-06T11:05:35.473Z
- Modified
- 2024-03-06T11:25:28.861Z
- Summary
- [none]
- Details
-
Subversion's moddavsvn is vulnerable to memory corruption. While looking up path-based authorization rules, moddavsvn servers may attempt to use memory which has already been freed. Affected Subversion moddavsvn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use moddavsvn are not affected.
- Database specific
{ "cpes": [ "cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:*" ], "severity": "High" }- References
-
- http://seclists.org/fulldisclosure/2022/Jul/18
- https://bz.apache.org/bugzilla/show_bug.cgi?id=65861
- https://cwiki.apache.org/confluence/display/HTTPD/ModuleLife
- https://issues.apache.org/jira/browse/SVN-4880
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/
- https://support.apple.com/kb/HT213345
- https://www.debian.org/security/2022/dsa-5119
Affected packages
Bitnami / subversion
Package
- Name
- subversion
- Purl
- pkg:bitnami/subversion
Severity
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator