TI-2021-09620 Aliases CVE-2021-28544 GHSA-q36f-8454-r4h2

Information disclosure in Apache Subversion

LOW 25CWE-200Published 2022-04-12 · Updated 2024-08-03

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Deferred Red Hat: fix deferred

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-200.

Summary

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

Why it matters now

EPSS 0.02788 86th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Deferred Red Hat: fix deferred

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Apache	Apache Subversion	1.10.0 to 1.14.1	—	No fix listed	CNA

Apache Subversion VendorApache Affected 1.10.0 to 1.14.1 Fixed in — No fix listed CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:apache:subversion::::::::	1.10.0 – 1.14.1	Vulnerable	Apache
cpe:2.3:o:debian:debian_linux:10.0:::::::*	10.0	Vulnerable	Debian
cpe:2.3:o:debian:debian_linux:11.0:::::::*	11.0	Vulnerable	Debian
cpe:2.3:o:fedoraproject:fedora:35:::::::*	35	Vulnerable	Fedoraproject
cpe:2.3:o:fedoraproject:fedora:36:::::::*	36	Vulnerable	Fedoraproject
cpe:2.3:o:apple:macos::::::::	12.0 to before 12.5	Vulnerable	Apple

cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:* Versions 1.10.0 – 1.14.1 Vulnerable ·Apache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* Versions 35 Vulnerable ·Fedoraproject
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* Versions 36 Vulnerable ·Fedoraproject
cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:* Versions 12.0 to before 12.5 Vulnerable ·Apple

Remediation

No fixed version listed by the sources yet.

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Advisory · 2022-04-12
Apache Subversion — FEDORA-2022-2af658b090
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-08026 Apache Subversion mod_dav_svn is vulnerable to memory corruptionPriority MEDIUM 44
Show all 2 records → Advisory →
Advisory · 2022-04-12
Apache Subversion — FEDORA-2022-13cc09ecf2
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-08026 Apache Subversion mod_dav_svn is vulnerable to memory corruptionPriority MEDIUM 44
Show all 2 records → Advisory →

Show 1 more group

Advisory · 2022-04-12
Apache Subversion — DSA-5119
2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW
Other records, highest priority first
- TI-2022-08026 Apache Subversion mod_dav_svn is vulnerable to memory corruptionPriority MEDIUM 44
Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat Enterprise Linux 6	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 7	Affected	No fix planned: Out of support scope
Red Hat Enterprise Linux 8	Affected	No fix yet: Fix deferred
Red Hat Enterprise Linux 9	Affected	No fix yet: Fix deferred

Timeline

2026-10-02 Threatist record created from CVE-2021-28544
2026-10-03 Alias added: GHSA-q36f-8454-r4h2

References

Exploit 1

https://subversion.apache.org/security/CVE-2021-28544-advisory.txt

Advisory 5

TI-2015-04418 Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache… CVSS 3.0HIGH 8.6
TI-2018-08457 Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will… CVSS 3.1HIGH 7.5
TI-2020-13273 Remote unauthenticated denial-of-service in Subversion mod_authz_svn CVSS 3.1HIGH 7.5
TI-2017-07180 Improper input validation in Apache Subversion CVSS 3.0CRITICAL 9.8
TI-2015-04497 Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before… CVSS 3.0HIGH 7.6
TI-2013-01858 contrib/hook-scripts/svn-keyword-check.pl in Subversion before 1.6.23 allows remote… CVSS 2.0HIGH 7.1

See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences