{"id":"CVE-2013-4558","aliases":["DEBIAN-CVE-2013-4558","EUVD-2013-4417","GHSA-6c6v-jhrm-ff4w","MGASA-2013-0360","SUSE-SU-2015:0709-1","UBUNTU-CVE-2013-4558","openSUSE-SU-2024:10538-1"],"status":"published","title":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in...","description":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.","severity":{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","level":"low","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.05882,"percentile":0.93266,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2013-11-30T21:37:01Z","modified":"2026-09-01T20:03:18Z","fixes":[{"ecosystem":"Debian:12","package":"subversion","fixed_in":["1.7.14-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"subversion","fixed_in":["1.7.14-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"subversion","fixed_in":["1.7.14-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1.mga3"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-1.1"}]}],"bundled":37}],"products":[{"vendor":"apache","product":"mod_dav_svn"},{"vendor":"apache","product":"subversion"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1033431","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://subversion.apache.org/security/CVE-2013-4558-advisory.txt","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","advisory","fix","report"]},{"url":"http://osvdb.org/100363","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-12/msg00029.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2013-12/msg00048.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://github.com/apache/subversion/commit/2c77c43e4255555f3b79f761f0d141393a3856cc","tags":["x_transferred","fix"]},{"url":"https://github.com/apache/subversion/commit/647e3f8365a74831bb915f63793b63e31fae062d","tags":["x_transferred","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-4558"},{"url":"https://github.com/advisories/GHSA-6c6v-jhrm-ff4w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-4558","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2013-0360.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=11780","tags":["report"]},{"url":"http://subversion.apache.org/security/CVE-2013-4505-advisory.txt","tags":["advisory"]},{"url":"https://mail-archives.apache.org/mod_mbox/subversion-dev/201311.mbox/%3C52937FE1.2030700@apache.org%3E","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/813913","tags":["report"]},{"url":"https://bugzilla.suse.com/821505","tags":["report"]},{"url":"https://bugzilla.suse.com/834014","tags":["report"]},{"url":"https://bugzilla.suse.com/836245","tags":["report"]},{"url":"https://bugzilla.suse.com/841205","tags":["report"]},{"url":"https://bugzilla.suse.com/850667","tags":["report"]},{"url":"https://bugzilla.suse.com/862459","tags":["report"]},{"url":"https://bugzilla.suse.com/889849","tags":["report"]},{"url":"https://bugzilla.suse.com/909935","tags":["report"]},{"url":"https://bugzilla.suse.com/910376","tags":["report"]},{"url":"https://bugzilla.suse.com/923794","tags":["report"]},{"url":"https://bugzilla.suse.com/923795","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0251","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2013-4558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-4558","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8734","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2013-4558","description":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.","status":"published","published":"2013-12-07T20:00:00Z","modified":"2024-08-06T16:45:14.812Z","updated_at":"2026-11-02T14:34:57.869657Z"}],"euvd":[{"id":"EUVD-2013-4417","description":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.","status":"published","published":"2013-12-07T20:00:00Z","modified":"2024-08-06T16:45:14Z","updated_at":"2026-11-03T01:56:31.667445Z"}],"ghsa":[{"id":"GHSA-6c6v-jhrm-ff4w","title":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in...","description":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.","status":"published","published":"2022-05-17T04:56:00Z","modified":"2024-04-07T05:07:24Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:57:03.777371Z"}],"nvd":[{"id":"CVE-2013-4558","description":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.","status":"published","published":"2013-12-07T20:55:02.553Z","modified":"2026-06-16T23:57:27.03Z","cvss":[{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:N/I:N/A:P","level":"low","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:44.596064Z"}],"osv":[{"id":"CVE-2013-4558","description":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.","status":"published","published":"2013-12-07T20:55:02Z","modified":"2026-04-16T06:22:10.224018698Z","updated_at":"2026-11-02T15:43:59.09154Z"},{"id":"DEBIAN-CVE-2013-4558","description":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.","status":"published","published":"2013-12-07T20:55:02.553Z","modified":"2026-09-01T20:03:18.433133094Z","updated_at":"2026-11-02T15:45:25.514579Z"},{"id":"MGASA-2013-0360","title":"Updated subversion package fixes security vulnerabilities","description":"mod_dontdothat allows you to block update REPORT requests against certain\npaths in the repository.  It expects the paths in the REPORT request to be\nabsolute URLs.  Serf based clients send relative URLs instead of absolute\nURLs in many cases.  As a result these clients are not blocked as\nconfigured by mod_dontdothat (CVE-2013-4505).\n\nWhen SVNAutoversioning is enabled via \"SVNAutoversioning on\", commits can\nbe made by single HTTP requests such as MKCOL and PUT.  If Subversion is\nbuilt with assertions enabled any such requests that have non-canonical\nURLs, such  as URLs with a trailing /, may trigger an assert.  An assert\nwill cause the Apache process to abort (CVE-2013-4558).\n","status":"published","published":"2013-11-30T21:37:01Z","modified":"2026-04-16T06:23:45.376672123Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10538-1","title":"libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 on GA media","description":"These are all security issues fixed in the libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:49:28.015865Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2015:0709-1","title":"Security update for subversion","description":"\nSubversion has been updated to fix a security problem:\n\n    * bnc#889849: Reveal authentication information through an md5\n      collision attack on authentication realm (CVE-2014-3528)\n\nSecurity Issues:\n\n    * CVE-2014-3528\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528\u003e\n\n","status":"published","published":"2014-08-19T23:56:28Z","modified":"2026-02-04T03:24:28.875941Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2013-4558","description":"The get_parent_resource function in repos.c in mod_dav_svn Apache HTTPD server module in Subversion 1.7.11 through 1.7.13 and 1.8.1 through 1.8.4, when built with assertions enabled and SVNAutoversioning is enabled, allows remote attackers to cause a denial of service (assertion failure and Apache process abort) via a non-canonical URL in a request, as demonstrated using a trailing /.","status":"withdrawn","published":"2013-12-07T20:55:00Z","modified":"2025-07-16T08:10:47.628359Z","updated_at":"2026-11-02T15:54:07.421078Z"}]}}