{"id":"CVE-2021-28544","aliases":["ALPINE-CVE-2021-28544","AZL-9367","BELL-CVE-2021-28544","BIT-subversion-2021-28544","CLSA-2026-1778894989","DEBIAN-CVE-2021-28544","DSA-5119-1","EUVD-2021-15220","GHSA-q36f-8454-r4h2","MGASA-2022-0140","OESA-2022-1647","SUSE-SU-2022:1161-1","SUSE-SU-2022:1162-1","SUSE-SU-2022:1483-1","UBUNTU-CVE-2021-28544","USN-5372-1","USN-5450-1","openSUSE-SU-2024:12007-1"],"status":"published","title":"Apache Subversion SVN authz protected copyfrom paths regression","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.02788,"percentile":0.86508,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-863"],"published":"2021-04-12T00:00:00Z","modified":"2026-10-24T10:31:00Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"subversion","fixed_in":["1.14.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"subversion","fixed_in":["1.14.2-1"],"sources":["osv"]},{"ecosystem":"Bitnami","package":"subversion","fixed_in":["1.14.2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_dav_svn","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-subversion","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-devel","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-gnome","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-javahl","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-libs","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-perl","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-ruby","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-tools","fixed_in":["1.14.1-5.el9_2.tuxcare.els2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"subversion","fixed_in":["1.14.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"subversion","fixed_in":["1.14.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"subversion","fixed_in":["1.14.2-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"subversion","fixed_in":["1.13.0-3ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"subversion","fixed_in":["1.14.1-3ubuntu0.22.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"subversion","ranges":[{"type":"SEMVER","events":[{"introduced":"1.10.0"},{"fixed":"1.14.2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"mod_dav_svn","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"python3-subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-gnome","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-javahl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"TuxCare:AlmaLinux:9.2","package":"subversion-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-5.el9_2.tuxcare.els2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.4-1+deb10u3"}]}],"versions":["1.10.4-1","1.10.4-1+deb10u1","1.10.4-1+deb10u2"],"bundled":2},{"source":"osv","ecosystem":"Debian:11","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-3+deb11u1"}]}],"versions":["1.14.1-3"],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.2-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-4.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.2-4.oe1"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-2.oe2203"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150000.3.21.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150300.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150300.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150300.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-150300.10.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.10.6-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-3ubuntu0.1"}]}],"versions":["1.10.6-1","1.10.6-1build1","1.13.0-1","1.13.0-1ubuntu1","1.13.0-2","1.13.0-2ubuntu2","1.13.0-3"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-3ubuntu0.22.04.1"}]}],"versions":["1.14.1-3","1.14.1-3build2","1.14.1-3build3","1.14.1-3build4"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.0-3ubuntu0.1"}]}],"versions":["1.10.6-1","1.10.6-1build1","1.13.0-1","1.13.0-1ubuntu1","1.13.0-2","1.13.0-2ubuntu2","1.13.0-3"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"subversion","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-3ubuntu0.22.04.1"}]}],"versions":["1.14.1-3","1.14.1-3build2","1.14.1-3build3","1.14.1-3build4"],"bundled":2}],"products":[{"vendor":"apache","product":"subversion"},{"vendor":"apache software foundation","product":"apache subversion"},{"vendor":"apple","product":"macos"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"https://subversion.apache.org/security/CVE-2021-28544-advisory.txt","tags":["x_refsource_MISC","x_transferred","Exploit","Patch","Vendor Advisory","web","fix","advisory"]},{"url":"https://www.debian.org/security/2022/dsa-5119","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://support.apple.com/kb/HT213345","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","web","advisory"]},{"url":"http://seclists.org/fulldisclosure/2022/Jul/18","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28544","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/"},{"url":"https://github.com/advisories/GHSA-q36f-8454-r4h2"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-28544","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-28544","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/almalinux9.2esu/CLSA-2026-1778894989.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28544","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0140.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30274","tags":["report"]},{"url":"https://subversion.apache.org/security/CVE-2022-24070-advisory.txt","tags":["advisory"]},{"url":"https://www.openwall.com/lists/oss-security/2022/04/12/2","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2022-1647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24070","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221161-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1197939","tags":["report"]},{"url":"https://bugzilla.suse.com/1197940","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-28544","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24070","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221162-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20221483-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1198503","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-28544","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5372-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-5450-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28544","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-24070","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-28544","title":"Apache Subversion SVN authz protected copyfrom paths regression","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2022-04-12T17:50:13Z","modified":"2024-08-03T21:47:32.637Z","cwes":["CWE-200"],"updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-15220","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2022-04-12T17:50:13Z","modified":"2024-08-03T21:47:32Z","updated_at":"2026-11-03T03:24:46.751124Z"}],"ghsa":[{"id":"GHSA-q36f-8454-r4h2","title":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal ...","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2022-04-13T00:00:22Z","modified":"2023-01-28T05:07:18Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200","CWE-863"],"updated_at":"2026-11-02T14:44:30.65038Z"}],"nvd":[{"id":"CVE-2021-28544","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2022-04-12T18:15:08.25Z","modified":"2026-06-17T03:46:30.183Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":3.5,"vector":"AV:N/AC:M/Au:S/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:07:06.029737Z"}],"osv":[{"id":"ALPINE-CVE-2021-28544","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2022-04-12T18:15:08.25Z","modified":"2026-10-23T17:17:56.16899568Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"AZL-9367","title":"CVE-2021-28544 affecting package subversion for versions less than 1.14.2-1","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2022-04-12T18:15:08Z","modified":"2026-04-21T04:35:01.925282Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:11.723718Z"},{"id":"BELL-CVE-2021-28544","title":"CVE-2021-28544 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:08.230161Z","modified":"2026-01-26T09:50:11.933212Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-28544","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2022-04-12T18:15:08.25Z","modified":"2026-10-24T10:31:00.622478381Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28544","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2022-04-12T18:15:08.25Z","modified":"2026-10-23T18:03:12.058099405Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"OESA-2022-1647","title":"subversion security update","description":"Subversion exists to be universally recognized and adopted as an open-source, centralized version control system characterized by its reliability as a safe haven for valuable data; the simplicity of its model and usage; and its ability to support the needs of a wide variety of users and projects, from individuals to large-scale enterprise operations.\r\n\r\nSecurity Fix(es):\r\n\r\nApache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal copyfrom paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the copyfrom path of the original. This also reveals the fact that the node was copied. Only the copyfrom path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.(CVE-2021-28544)\n\nSubversion s mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.(CVE-2022-24070)","status":"published","published":"2022-05-11T11:04:55Z","modified":"2026-08-18T01:16:33.331704982Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:39.528805Z"},{"id":"UBUNTU-CVE-2021-28544","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2021-04-12T00:00:00Z","modified":"2026-04-22T12:49:57.108827Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.779273Z"},{"id":"BIT-subversion-2021-28544","title":"Apache Subversion SVN authz protected copyfrom paths regression","description":"Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.","status":"published","published":"2024-03-06T11:05:44.98Z","modified":"2025-05-20T10:02:07.006Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"CLSA-2026-1778894989","title":"subversion: Fix of CVE-2021-28544","description":"- CVE-2021-28544: fix authz copyfrom path information leak in svn log -v","status":"published","published":"2026-05-16T01:29:54Z","modified":"2026-06-01T00:32:31.465303307Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DSA-5119-1","title":"subversion - security update","status":"published","published":"2022-04-13T00:00:00Z","modified":"2026-03-09T02:10:27.929204Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0140","title":"Updated subversion packages fix security vulnerability","description":"SVN authz protected copyfrom paths regression. (CVE-2021-28544)\nSubversion's mod_dav_svn is vulnerable to memory corruption.\n(CVE-2022-24070)\n","status":"published","published":"2022-04-13T16:06:19Z","modified":"2026-04-16T04:41:37.646403352Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:12007-1","title":"libsvn_auth_gnome_keyring-1-0-1.14.2-1.1 on GA media","description":"These are all security issues fixed in the libsvn_auth_gnome_keyring-1-0-1.14.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:40:47.231474Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"SUSE-SU-2022:1161-1","title":"Security update for subversion","description":"This update for subversion fixes the following issues:\n\n- CVE-2022-24070: Fixed a memory corruption issue in mod_dav_svn as used by Apache\n  HTTP server. This could be exploited by a remote attacker to cause a denegation\n  of service (bsc#1197940).\n- CVE-2021-28544: Fixed an information leak issue where Subversion servers may\n  reveal the original path of files protected by path-based authorization\n  (bsc#1197939).\n","status":"published","published":"2022-04-12T12:55:21Z","modified":"2026-02-04T03:57:47.533221Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1162-1","title":"Security update for subversion","description":"This update for subversion fixes the following issues:\n\n- CVE-2022-24070: Fixed a memory corruption issue in mod_dav_svn as used by Apache\n  HTTP server. This could be exploited by a remote attacker to cause a denial of\n  service (bsc#1197940).\n- CVE-2021-28544: Fixed an information leak issue where Subversion servers may\n  reveal the original path of files protected by path-based authorization\n  (bsc#1197939).\n","status":"published","published":"2022-04-12T12:58:42Z","modified":"2026-02-04T02:40:56.282474Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:1483-1","title":"Security update for subversion","description":"This update for subversion fixes the following issues:\n    \n- CVE-2022-24070: Fixed a memory corruption issue in mod_dav_svn as used by Apache HTTP server. This could be exploited by a remote attacker to cause a denial of service (bsc#1197940).\n- CVE-2021-28544: Fixed an information leak issue where Subversion servers may reveal the original path of files protected by path-based authorization (bsc#1197939).\n\n\nThe following non-security bugs were fixed:\n\n- Skip failing test on s390[x] (bsc#1198503).\n","status":"published","published":"2022-05-02T14:45:26Z","modified":"2026-02-04T03:20:56.136417Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"USN-5372-1","title":"subversion vulnerabilities","description":"Evgeny Kotkov discovered that Subversion servers did not properly follow\npath-based authorization rules in certain cases. An attacker could\npotentially use this issue to retrieve information about private paths.\n(CVE-2021-28544)\n\nThomas Weißschuh discovered that Subversion servers did not properly handle\nmemory in certain configurations. A remote attacker could potentially use\nthis issue to cause a denial of service or other unspecified impact.\n(CVE-2022-24070)\n","status":"published","published":"2022-04-12T17:08:51Z","modified":"2026-04-22T10:23:03.879309Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5450-1","title":"subversion vulnerabilities","description":"Evgeny Kotkov discovered that subversion servers did not properly follow\npath-based authorization rules in certain cases. An attacker could\npotentially use this issue to retrieve information about private paths.\n(CVE-2021-28544)\n\nThomas Weißschuh discovered that subversion servers did not properly handle\nmemory in certain configurations. A remote attacker could potentially use\nthis issue to cause a denial of service or other unspecified impact.\n(CVE-2022-24070)\n","status":"published","published":"2022-05-27T01:00:42Z","modified":"2026-04-22T10:24:41.748993Z","updated_at":"2026-11-02T16:58:16.20937Z"}]}}