Bug 500482 – <dev-vcs/subversion-{1.7.16,1.8.8}: mod_dav_svn crash when handling certain requests with SVNListParentPath on (CVE-2014-0032)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2014-02-06 08:43:08 UTC]

From ${URL} :

A mod_dav_svn crash was reported when SVNListParentPath is on:

http://mail-archives.apache.org/mod_mbox/subversion-dev/201401.mbox/%3CCANvU9scLHr2yOLABW8q6_wNzhEf7pWM=[e-mail]%3E

Certain requests could cause mod_dav_svn to crash.

This has been corrected in version 1.7.15:

https://svn.apache.org/repos/asf/subversion/branches/1.7.x/CHANGES

Upstream fix for CVE-2014-0032:

http://svn.apache.org/viewvc?view=revision&revision=r1557320


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.

[Comment 1 Kristian Fiskerstrand (RETIRED) 2014-06-22 16:25:21 UTC]

This issue is fixed in 1.7.16 (1.7.15 was never released) and 1.8.8 according to http://svn.apache.org/repos/asf/subversion/trunk/CHANGES 

@maintainers: is 1.8.8 or 1.8.9 ready for stabilization? I notice the latest 1.7.x series we have in tree is still 1.7.14.

[Comment 2 Thomas Sachau 2014-07-20 10:17:47 UTC]

(In reply to Kristian Fiskerstrand from comment #1)
> This issue is fixed in 1.7.16 (1.7.15 was never released) and 1.8.8
> according to http://svn.apache.org/repos/asf/subversion/trunk/CHANGES 
> 
> @maintainers: is 1.8.8 or 1.8.9 ready for stabilization? I notice the latest
> 1.7.x series we have in tree is still 1.7.14.

1.7.17 was added on the first of june so should be ready for stabilization too

[Comment 3 Kristian Fiskerstrand (RETIRED) 2014-07-20 12:37:49 UTC]

Arches, please test and mark stable

=dev-vcs/subversion-1.7.17

Targets: alpha amd64 arm arm64 hppa ia64 ppc ppc64 sparc x86

[Comment 4 GLSAMaker/CVETool Bot 2014-07-20 21:02:06 UTC]

CVE-2014-0032 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0032):
  The get_resource function in repos.c in the mod_dav_svn module in Apache
  Subversion before 1.7.15 and 1.8.x before 1.8.6, when SVNListParentPath is
  enabled, allows remote attackers to cause a denial of service (crash) via
  vectors related to the server root and request methods other than GET, as
  demonstrated by the "svn ls http://svn.example.com" command.

[Comment 5 Tobias Klausmann (RETIRED) 2014-07-23 15:25:57 UTC]

Stable on alpha.

[Comment 6 Tom Gall (RETIRED) 2014-07-23 21:27:48 UTC]

stable arm64

[Comment 7 Markus Meier 2014-07-24 19:23:36 UTC]

arm stable

[Comment 8 Jeroen Roovers (RETIRED) 2014-07-29 23:52:16 UTC]

Stable for HPPA.

[Comment 9 Agostino Sarubbo 2014-08-02 13:44:19 UTC]

amd64 stable

[Comment 10 Agostino Sarubbo 2014-08-02 13:47:57 UTC]

x86 stable

[Comment 11 Raúl Porcel (RETIRED) 2014-08-04 18:36:46 UTC]

ia64/sparc stable

[Comment 12 Agostino Sarubbo 2014-08-08 21:42:28 UTC]

ppc stable

[Comment 13 Agostino Sarubbo 2014-08-09 10:49:30 UTC]

ppc64 stable.

Maintainer(s), please cleanup.
Security, please vote.

[Comment 14 Thomas Sachau 2014-08-14 16:57:25 UTC]

older versions for the 1.7 series removed, latest one is now 1.7.17, which will be removed once stabilization for bug 519202 is done.

[Comment 15 Kristian Fiskerstrand (RETIRED) 2015-05-11 20:49:00 UTC]

Cleanup already done.

GLSA Vote: No

[Comment 16 Kristian Fiskerstrand (RETIRED) 2015-05-11 20:49:41 UTC]

(In reply to Kristian Fiskerstrand from comment #15)
> Cleanup already done.
> 
> GLSA Vote: No

Adding as GLSA to existing request 8cfee74a1

[Comment 17 GLSAMaker/CVETool Bot 2016-10-11 12:47:00 UTC]

This issue was resolved and addressed in
 GLSA 201610-05 at https://security.gentoo.org/glsa/201610-05
by GLSA coordinator Aaron Bauman (b-man).