{"id":"CVE-2014-3528","aliases":["DEBIAN-CVE-2014-3528","EUVD-2014-3525","GHSA-vxf6-xw9g-6cfc","MGASA-2014-0338","MGASA-2014-0339","RHSA-2015:0165","RHSA-2015:0166","SUSE-SU-2015:0709-1","UBUNTU-CVE-2014-3528","USN-2316-1","openSUSE-SU-2024:10538-1"],"status":"published","title":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of...","description":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.","severity":{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.07396,"percentile":0.94468,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-255"],"published":"2014-08-05T00:00:00Z","modified":"2026-10-23T15:47:24Z","fixes":[{"ecosystem":"Debian:12","package":"subversion","fixed_in":["1.8.10-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"subversion","fixed_in":["1.8.10-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"subversion","fixed_in":["1.8.10-1"],"sources":["osv"]},{"ecosystem":"Mageia:3","package":"subversion","fixed_in":["1.7.14-1.2.mga3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"subversion","fixed_in":["1.8.8-1ubuntu3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7.14-1.2.mga3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.10-1.mga4"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"subversion-svn2cl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"subversion-svn2cl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"subversion-svn2cl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"subversion-svn2cl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.6.11-12.el6_6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"subversion-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"subversion-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"subversion-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-kde","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-python","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"subversion-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.7.14-7.el7_0"}]}],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu3.1"}]}],"versions":["1.7.9-1+nmu6ubuntu3","1.7.13-2ubuntu1","1.7.13-2ubuntu2","1.7.13-2ubuntu3","1.7.14-1ubuntu2","1.8.5-2ubuntu3","1.8.8-1ubuntu2","1.8.8-1ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.8.8-1ubuntu3.1"}]}],"versions":["1.7.9-1+nmu6ubuntu3","1.7.13-2ubuntu1","1.7.13-2ubuntu2","1.7.13-2ubuntu3","1.7.14-1ubuntu2","1.8.5-2ubuntu3","1.8.8-1ubuntu2","1.8.8-1ubuntu3"],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.9.5-1.1"}]}],"bundled":37}],"products":[{"vendor":"apache","product":"subversion"},{"vendor":"apple","product":"xcode"},{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"opensuse","product":"opensuse"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_hpc_node"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_server_eus"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"http://secunia.com/advisories/59432","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2316-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Vendor Advisory","advisory"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0166.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://support.apple.com/HT204427","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/68995","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://subversion.apache.org/security/CVE-2014-3528-advisory.txt","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","article","report"]},{"url":"http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html","tags":["vendor-advisory","x_refsource_APPLE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-0165.html","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/60722","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"https://security.gentoo.org/glsa/201610-05","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59584","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3528","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-vxf6-xw9g-6cfc"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-3528","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0338.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13838","tags":["report"]},{"url":"http://www.ubuntu.com/usn/usn-2316-1/","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0339.html","tags":["advisory"]},{"url":"http://subversion.apache.org/security/CVE-2014-3522-advisory.txt","tags":["advisory"]},{"url":"https://mail-archives.apache.org/mod_mbox/subversion-dev/201408.mbox/%3C53E8E6BA.5030100@apache.org%3E","tags":["web"]},{"url":"http://svn.apache.org/repos/asf/subversion/tags/1.8.10/CHANGES","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0165","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://subversion.apache.org/security/CVE-2014-3528-advisory.txt","tags":["article"]},{"url":"https://subversion.apache.org/security/CVE-2014-3580-advisory.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1125799","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174054","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0165.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3528","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3528","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-3580","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-3580","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-3580","tags":["advisory"]},{"url":"http://subversion.apache.org/security/CVE-2014-3580-advisory.txt","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2015:0166","tags":["advisory"]},{"url":"https://subversion.apache.org/security/CVE-2014-8108-advisory.txt","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1174057","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0166.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2014-8108","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-8108","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-8108","tags":["advisory"]},{"url":"http://subversion.apache.org/security/CVE-2014-8108-advisory.txt","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150709-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/813913","tags":["report"]},{"url":"https://bugzilla.suse.com/821505","tags":["report"]},{"url":"https://bugzilla.suse.com/834014","tags":["report"]},{"url":"https://bugzilla.suse.com/836245","tags":["report"]},{"url":"https://bugzilla.suse.com/841205","tags":["report"]},{"url":"https://bugzilla.suse.com/850667","tags":["report"]},{"url":"https://bugzilla.suse.com/862459","tags":["report"]},{"url":"https://bugzilla.suse.com/889849","tags":["report"]},{"url":"https://bugzilla.suse.com/909935","tags":["report"]},{"url":"https://bugzilla.suse.com/910376","tags":["report"]},{"url":"https://bugzilla.suse.com/923794","tags":["report"]},{"url":"https://bugzilla.suse.com/923795","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1845","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1846","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1849","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-1968","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4277","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4505","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0032","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3528","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0248","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0251","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-3528","tags":["report"]},{"url":"http://mail-archives.apache.org/mod_mbox/subversion-dev/201407.mbox/%3C53DAB4A7.8030004%40reser.org%3E","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2316-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2014-0032","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-3522","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-2411","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3315","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-4644","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0715","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1921","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2088","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4246","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-4262","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3522","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-0202","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5259","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5343","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2167","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2168","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-8734","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-3528","description":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.","status":"published","published":"2014-08-19T18:00:00Z","modified":"2024-08-06T10:50:16.884Z","updated_at":"2026-11-02T14:33:44.23164Z"}],"euvd":[{"id":"EUVD-2014-3525","description":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.","status":"published","published":"2014-08-19T18:00:00Z","modified":"2024-08-06T10:50:16Z","updated_at":"2026-11-03T01:57:10.446744Z"}],"ghsa":[{"id":"GHSA-vxf6-xw9g-6cfc","title":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of...","description":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.","status":"published","published":"2022-05-14T02:09:29Z","modified":"2023-02-02T05:05:34Z","updated_at":"2026-11-02T14:52:08.173225Z"}],"nvd":[{"id":"CVE-2014-3528","description":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.","status":"published","published":"2014-08-19T18:55:02.687Z","modified":"2026-06-17T00:08:23.733Z","cvss":[{"version":"2.0","score":4,"vector":"AV:N/AC:H/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-255"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"CVE-2014-3528","description":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.","status":"published","published":"2014-08-19T18:55:02Z","modified":"2026-04-16T06:18:07.56438052Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-3528","description":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.","status":"published","published":"2014-08-19T18:55:02.687Z","modified":"2026-10-23T15:47:24.99245463Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0338","title":"Updated subversion packages fix CVE-2014-3528","description":"Updated subversion packages fix security vulnerability:\n\nBert Huijben discovered that Subversion did not properly handle cached\ncredentials. A malicious server could possibly use this issue to obtain\ncredentials cached for a different server (CVE-2014-3528).\n\nThe subversion package has been patched to fix this issue.\n","status":"published","published":"2014-08-21T09:36:13Z","modified":"2026-04-16T06:25:46.600280319Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0339","title":"Updated subversion packages fix security vulnerabilities","description":"Updated subversion packages fix security vulnerabilities:\n\nBen Reser discovered that Subversion did not correctly validate SSL\ncertificates containing wildcards. A remote attacker could exploit this to\nperform a man in the middle attack to view sensitive information or alter\nencrypted communications (CVE-2014-3522).\n\nBert Huijben discovered that Subversion did not properly handle cached\ncredentials. A malicious server could possibly use this issue to obtain\ncredentials cached for a different server (CVE-2014-3528).\n\nThe subversion package has been updated to 1.8.10 to fix these issues and\nother bugs.\n","status":"published","published":"2014-08-21T09:36:13Z","modified":"2026-04-16T06:25:07.15515644Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10538-1","title":"libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 on GA media","description":"These are all security issues fixed in the libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:49:28.015865Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2015:0165","title":"Red Hat Security Advisory: subversion security update","status":"published","published":"2024-09-15T22:16:47Z","modified":"2026-06-28T10:13:01Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"RHSA-2015:0166","title":"Red Hat Security Advisory: subversion security update","status":"published","published":"2024-09-15T22:16:54Z","modified":"2026-06-28T10:13:02Z","updated_at":"2026-11-02T15:53:02.532052Z"},{"id":"SUSE-SU-2015:0709-1","title":"Security update for subversion","description":"\nSubversion has been updated to fix a security problem:\n\n    * bnc#889849: Reveal authentication information through an md5\n      collision attack on authentication realm (CVE-2014-3528)\n\nSecurity Issues:\n\n    * CVE-2014-3528\n      \u003chttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3528\u003e\n\n","status":"published","published":"2014-08-19T23:56:28Z","modified":"2026-02-04T03:24:28.875941Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2014-3528","description":"Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.","status":"published","published":"2014-08-05T00:00:00Z","modified":"2026-04-22T09:39:43.817406Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2316-1","title":"subversion vulnerabilities","description":"Lieven Govaerts discovered that the Subversion mod_dav_svn module\nincorrectly handled certain request methods when SVNListParentPath was\nenabled. A remote attacker could use this issue to cause the server to\ncrash, resulting in a denial of service. This issue only affected Ubuntu\n12.04 LTS. (CVE-2014-0032)\n\nBen Reser discovered that Subversion did not correctly validate SSL\ncertificates containing wildcards. A remote attacker could exploit this to\nperform a machine-in-the-middle attack to view sensitive information or alter\nencrypted communications. (CVE-2014-3522)\n\nBert Huijben discovered that Subversion did not properly handle cached\ncredentials. A malicious server could possibly use this issue to obtain\ncredentials cached for a different server. (CVE-2014-3528)\n","status":"published","published":"2014-08-14T17:42:53Z","modified":"2026-04-22T08:58:48.631224Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}