Bugzilla – Bug 939517
VUL-1: CVE-2015-3187: subversion: svn_repos_trace_node_locations() reveals paths hidden by authz
Last modified: 2017-08-17 14:39:04 UTC
Summary ======= Subversion servers, both httpd and svnserve, will reveal some paths that should be hidden by path-based authz. When a node is copied from an unreadable location to a readable location the unreadable path may be revealed. This vulnerablity only reveals the path, it does not reveal the contents of the path. Known vulnerable ================ Subversion 1.8.0 to 1.8.13 Subversion 1.7.0 to 1.7.20 All older versions Known fixed =========== Subversion 1.8.14 Subversion 1.7.21 Details ======= The function svn_repos_trace_node_locations() follows the history of a node through earlier revisions and shows any copies. It should stop following history when an unreadable path is encountered but an implementation error causes the first unreadable path to be returned in some circumstances. This only reveals the unreadable path, it does not reveal the content of the file or directory at that path. Any attempts to obtain the content will fail with an authorization error. Examples: 1. After copying "unreadable-path" to "readable-path" then following the history of "readable-path" may reveal "unreadable-path". 2. After copying "unreadable/some-path" to "readable/other-path" then following the history of "readable/other-path" may reveal "unreadable/some-path". Severity ======== CVSSv2 Base Score: 3.5 CVSSv2 Base Vector: AV:N/AC:M/Au:S/C:P/I:N/A:N Recommendations =============== All Subversion servers using path-based authz to deny read access to sensitive paths should be upgraded. References ========== CVE-2015-3187 (Subversion) Reported by =========== C. Michael Pilato, CollabNet
Created attachment 642018 [details] patch for 1.7.20
Created attachment 642019 [details] patch for 1.8.13
bugbot adjusting priority
Adding to CC a community member who is a member of the upstream project and aware of the advisory and embargoed information.
This is an autogenerated message for OBS integration: This bug (939517) was mentioned in https://build.opensuse.org/request/show/320903 Factory / subversion https://build.opensuse.org/request/show/320904 13.2 / subversion
This is an autogenerated message for OBS integration: This bug (939517) was mentioned in https://build.opensuse.org/request/show/320911 13.1 / subversion
This is an autogenerated message for OBS integration: This bug (939517) was mentioned in https://build.opensuse.org/request/show/320945 Factory / subversion
public
openSUSE-SU-2015:1401-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 939514,939517 CVE References: CVE-2015-3184,CVE-2015-3187 Sources used: openSUSE 13.2 (src): subversion-1.8.14-2.17.1 openSUSE 13.1 (src): subversion-1.8.14-2.39.1
released
SUSE-SU-2015:1473-1: An update that fixes two vulnerabilities is now available. Category: security (moderate) Bug References: 939514,939517 CVE References: CVE-2015-3184,CVE-2015-3187 Sources used: SUSE Linux Enterprise Software Development Kit 12 (src): subversion-1.8.10-15.1
openSUSE-SU-2015:2363-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 939514,939517,958300 CVE References: CVE-2015-3184,CVE-2015-3187,CVE-2015-5343 Sources used: openSUSE Leap 42.1 (src): subversion-1.8.10-6.1
SUSE-SU-2016:1511-1: An update that fixes three vulnerabilities is now available. Category: security (moderate) Bug References: 939517,976849,976850 CVE References: CVE-2015-3187,CVE-2016-2167,CVE-2016-2168 Sources used: SUSE Studio Onsite 1.3 (src): subversion-1.6.17-1.35.1 SUSE Linux Enterprise Software Development Kit 11-SP4 (src): subversion-1.6.17-1.35.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): subversion-1.6.17-1.35.1
SUSE-SU-2017:2200-1: An update that solves 12 vulnerabilities and has 7 fixes is now available. Category: security (important) Bug References: 1011552,1026936,1051362,897033,909935,911620,916286,923793,923794,923795,939514,939517,942819,958300,969159,976849,976850,977424,983938 CVE References: CVE-2014-3580,CVE-2014-8108,CVE-2015-0202,CVE-2015-0248,CVE-2015-0251,CVE-2015-3184,CVE-2015-3187,CVE-2015-5343,CVE-2016-2167,CVE-2016-2168,CVE-2016-8734,CVE-2017-9800 Sources used: SUSE Linux Enterprise Software Development Kit 12-SP3 (src): subversion-1.8.19-25.3.1 SUSE Linux Enterprise Software Development Kit 12-SP2 (src): subversion-1.8.19-25.3.1