Red Hat Security AdvisoryRHSA-2017:2480
subversion security update
Released 2017-08-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client Optional (v. 7) mod_dav_svn-1.7.14-11.el7_4, subversion-1.7.14-11.el7_4, subversion-devel-1.7.14-11.el7_4 +8
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) mod_dav_svn-1.7.14-11.el7_4, subversion-1.7.14-11.el7_4, subversion-devel-1.7.14-11.el7_4 +8
- Red Hat Enterprise Linux Server (v. 7) mod_dav_svn-1.7.14-11.el7_4, subversion-1.7.14-11.el7_4, subversion-1.7.14-11.el7_4.ppc +4
- Red Hat Enterprise Linux Server Optional (v. 7) subversion-devel-1.7.14-11.el7_4, subversion-devel-1.7.14-11.el7_4.ppc, subversion-javahl-1.7.14-11.el7_4 +9
- Red Hat Enterprise Linux Workstation (v. 7) mod_dav_svn-1.7.14-11.el7_4, subversion-1.7.14-11.el7_4, subversion-gnome-1.7.14-11.el7_4 +1
- Red Hat Enterprise Linux Workstation Optional (v. 7) subversion-devel-1.7.14-11.el7_4, subversion-javahl-1.7.14-11.el7_4, subversion-kde-1.7.14-11.el7_4 +4
Fixes 1 record
Priority MEDIUM 60
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.18892 · Published 2017-08-11 · Partial fix CWE-20
