Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. This can lead to disruption for users of the server.Ī maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a recursive directory listing operation. This can lead to disruption for users of the server. In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. The successor to Axis 1.x is Axis2, the latest version is 1.7.9 and is not vulnerable to this issue. Security and bug commits commits continue in the projects Axis 1.x Subversion repository, legacy users are encouraged to build from source. Both httpd and svnserve servers are vulnerable.Ī Server Side Request Forgery (SSRF) vulnerability affected the Apache Axis 1.4 distribution that was last released in 2006.

Only the 'copyfrom' path is revealed not its contents. This also reveals the fact that the node was copied. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules.

Svn keyword