CVE-2024-46901: It has been discovered that the patch for CVE-2013-1968 was incomplete and unintentionally left mod_dav_svn vulnerable to control characters in filenames. If a path or a revision-property which contains control characters is committed to a repository then SVN operations served by mod_dav_svn can be disrupted. The above is fixed in 1.14.5.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=13db8a65e920fdde423050e03c0de869205d921f commit 13db8a65e920fdde423050e03c0de869205d921f Author: Sam James <sam@gentoo.org> AuthorDate: 2025-01-15 20:22:37 +0000 Commit: Sam James <sam@gentoo.org> CommitDate: 2025-01-15 20:22:37 +0000 dev-vcs/subversion: add 1.14.5 Closes: https://bugs.gentoo.org/923938 Closes: https://bugs.gentoo.org/932536 Closes: https://bugs.gentoo.org/945483 Bug: https://bugs.gentoo.org/946153 Signed-off-by: Sam James <sam@gentoo.org> dev-vcs/subversion/Manifest | 1 + dev-vcs/subversion/subversion-1.14.5.ebuild | 444 ++++++++++++++++++++++++++++ 2 files changed, 445 insertions(+)
subversion-1.14.5 is still on python-3.11, is 3.12 possible ?
(In reply to Joakim Tjernlund from comment #2) > subversion-1.14.5 is still on python-3.11, is 3.12 possible ? commit b09cbe95a1c35b0eb6a4f79f2d3648530c15a6f8 Author: Andreas K. Hüttel <dilfridge@gentoo.org> Date: Sun Feb 16 14:14:29 2025 +0100 dev-vcs/subversion: enable py3.12, py3.13 Signed-off-by: Andreas K. Hüttel <dilfridge@gentoo.org>
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=eb8fbfbc871181ab276ceba62a13a4333fea2b5a commit eb8fbfbc871181ab276ceba62a13a4333fea2b5a Author: Andreas Sturmlechner <asturm@gentoo.org> AuthorDate: 2025-04-26 11:46:10 +0000 Commit: Andreas Sturmlechner <asturm@gentoo.org> CommitDate: 2025-04-26 11:47:49 +0000 dev-vcs/subversion: 1.14.3 security cleanup, drop 1.14.5 Bug: https://bugs.gentoo.org/946153 Signed-off-by: Andreas Sturmlechner <asturm@gentoo.org> dev-vcs/subversion/Manifest | 1 - .../files/subversion-1.14.3-ruby-c99.patch | 28 -- dev-vcs/subversion/subversion-1.14.3.ebuild | 445 -------------------- dev-vcs/subversion/subversion-1.14.5.ebuild | 446 --------------------- 4 files changed, 920 deletions(-)
