CVE-2019-0203

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

Security Fix(es):

• subversion: NULL pointer dereference in svnserve leading to an unauthenticated remote DoS (CVE-2019-0203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.

Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

Security Fix(es):

• subversion: NULL pointer dereference in svnserve leading to an unauthenticated remote DoS (CVE-2019-0203)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Updated subversion packages fix security vulnerabilities:

Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer (CVE-2018-11782).

Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands (CVE-2019-0203).

This update for subversion to version 1.10.6 fixes the following issues:

Security issues fixed:

• CVE-2018-11782: Fixed a remote denial of service in svnserve 'get-deleted-rev' (bsc#1142743).
• CVE-2019-0203: Fixed a remote, unauthenticated denial of service in svnserve (bsc#1142721).

This update was imported from the SUSE:SLE-15:Update update project.

These are all security issues fixed in the libsvn_auth_gnome_keyring-1-0-1.14.1-1.11 package on the GA media of openSUSE Tumbleweed.

This update for subversion to version 1.10.6 fixes the following issues:

Security issues fixed:

• CVE-2018-11782: Fixed a remote denial of service in svnserve 'get-deleted-rev' (bsc#1142743).
• CVE-2019-0203: Fixed a remote, unauthenticated denial of service in svnserve (bsc#1142721).

This update for subversion fixes the following issues:

Security issues fixed:

• CVE-2018-11782: Fixed a remote denial of service in svnserve 'get-deleted-rev' (bsc#1142743).
• CVE-2019-0203: Fixed a remote, unauthenticated denial of service in svnserve (bsc#1142721).

Non-security issues fixed:

• Add instructions for running svnserve as a user different from 'svn', and remove sysconfig variables that are no longer effective with the systemd unit. bsc#1049448

Ace Olszowka discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker could possibly use this issue to cause svnserver to crash, resulting in a denial of service. (CVE-2018-11782)

Tomas Bortoli discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker could possibly use this issue to cause svnserver to crash, resulting in a denial of service. (CVE-2019-0203)

Ace Olszowka discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2018-11782)

Tomas Bortoli discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue only affected Ubuntu 18.04 LTS. (CVE-2019-0203)

Thomas Åkesson discovered that Subversion incorrectly handled certain inputs. An attacker could possibly use this issue to cause a denial of service. (CVE-2020-17525)