In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2020:4712 advisory.

  - In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a well-formed read-only request produces a particular answer. This can lead to     disruption for users of the server. (CVE-2018-11782)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-4712 advisory.

  - In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a well-formed read-only request produces a particular answer. This can lead to     disruption for users of the server. (CVE-2018-11782)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-3972 advisory.

    [1.7.14-16]
    - add security fix for CVE-2018-11782

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5445-1 advisory.

    Ace Olszowka discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker     could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue     only affected Ubuntu 18.04 LTS. (CVE-2018-11782)

    Tomas Bortoli discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker     could possibly use this issue to cause svnserver to crash, resulting in a denial of service. This issue     only affected Ubuntu 18.04 LTS. (CVE-2019-0203)

    Thomas kesson discovered that Subversion incorrectly handled certain inputs. An attacker could possibly     use this issue to cause a denial of service. (CVE-2020-17525)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

According to the versions of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a well-formed read-only request produces a particular answer. This can lead to     disruption for users of the server. (CVE-2018-11782)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has subversion packages installed that are affected by a vulnerability:

  - In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a well-formed read-only request produces a particular answer. This can lead to     disruption for users of the server. (CVE-2018-11782)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has subversion packages installed that are affected by a vulnerability:

  - In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a well-formed read-only request produces a particular answer. This can lead to     disruption for users of the server. (CVE-2018-11782)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to the version of the subversion packages installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - In Apache Subversion versions up to and including     1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a well-formed read-only request     produces a particular answer. This can lead to     disruption for users of the server.(CVE-2018-11782)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2020:4712 advisory.

  - subversion: remotely triggerable DoS vulnerability in svnserve 'get-deleted-rev' (CVE-2018-11782)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:4712 advisory.

    Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in     developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

    Security Fix(es):

    * subversion: remotely triggerable DoS vulnerability in svnserve 'get-deleted-rev' (CVE-2018-11782)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of subversion installed on the remote host is prior to 1.7.14-16. It is, therefore, affected by a vulnerability as referenced in the ALAS2-2020-1549 advisory.

    In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a well-formed read-only request produces a particular answer. This can lead to     disruption for users of the server. (CVE-2018-11782)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security Fix(es) :

  - subversion: remotely triggerable DoS vulnerability in     svnserve 'get-deleted-rev' (CVE-2018-11782)

The remote CentOS Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3972 advisory.

  - In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server     process may exit when a well-formed read-only request produces a particular answer. This can lead to     disruption for users of the server. (CVE-2018-11782)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3972 advisory.

    Subversion (SVN) is a concurrent version control system which enables one or more users to collaborate in     developing and maintaining a hierarchy of files and directories while keeping a history of all changes.

    Security Fix(es):

    * subversion: remotely triggerable DoS vulnerability in svnserve 'get-deleted-rev' (CVE-2018-11782)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server.(CVE-2018-11782)

In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server.(CVE-2019-0203)

An update of the subversion package has been released.

Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems :

CVE-2018-11782

Ace Olszowka reported that the Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer, leading to a denial of service.

CVE-2019-0203

Tomas Bortoli reported that the Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands.
If the server is configured with anonymous access enabled this could lead to a remote unauthenticated denial of service.

For Debian 8 'Jessie', these problems have been fixed in version 1.8.10-6+deb8u7.

We recommend that you upgrade your subversion packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for subversion to version 1.10.6 fixes the following issues :

Security issues fixed :

  - CVE-2018-11782: Fixed a remote denial of service in     svnserve 'get-deleted-rev' (bsc#1142743).

  - CVE-2019-0203: Fixed a remote, unauthenticated denial of     service in svnserve (bsc#1142721).

This update was imported from the SUSE:SLE-15:Update update project.

The remote Ubuntu 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4082-1 advisory.

    Ace Olszowka discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker     could possibly use this issue to cause svnserver to crash, resulting in a denial of service.
    (CVE-2018-11782)

    Tomas Bortoli discovered that Subversion incorrectly handled certain svnserve requests. A remote attacker     could possibly use this issue to cause svnserver to crash, resulting in a denial of service.
    (CVE-2019-0203)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for subversion to version 1.10.6 fixes the following issues :

Security issues fixed :

CVE-2018-11782: Fixed a remote denial of service in svnserve 'get-deleted-rev' (bsc#1142743).

CVE-2019-0203: Fixed a remote, unauthenticated denial of service in svnserve (bsc#1142721).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update includes the latest stable release of _Apache Subversion_, version **1.12.2**. This update addresses two security vulnerabilities in **svnserve**, `CVE-2018-11782` and `CVE-2019-0203`. For more information, see :

http://subversion.apache.org/security/CVE-2018-11782-advisory.txt http://subversion.apache.org/security/CVE-2019-0203-advisory.txt

## User-visible changes :

  - Fix conflict resolver bug: local and incoming edits     swapped. 

  - Fix memory lifetime problem in a libsvn_wc error code     path.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were discovered in Subversion, a version control system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2018-11782     Ace Olszowka reported that the Subversion's svnserve     server process may exit when a well-formed read-only     request produces a particular answer, leading to a     denial of service.

  - CVE-2019-0203     Tomas Bortoli reported that the Subversion's svnserve     server process may exit when a client sends certain     sequences of protocol commands. If the server is     configured with anonymous access enabled this could lead     to a remote unauthenticated denial of service.

The installed version of Subversion Server is prior to 1.9.11, 1.10.x prior to 1.10.5, 1.11.x or 1.12.x prior to 1.12.1 and is, therefore, affected by multiple vulnerabilities:

 - A denial of service (DoS) vulnerability exists in Subversion's svnserve server process due to that the process may exit    when a well-formed read-only request produces a particular answer. A remote authenticated attacker can exploit this issue    to cause a denial of service attack. (CVE-2018-11782)

 - A denial of service (DoS) vulnerability exists in Subversion's svnserve server process due to that the process may exit    when a client sends certain sequences of protocol commands. A remote unauthenticated attacker can exploit this issue,    If the server is configured with anonymous access enabled, to cause a remote denial of service attack. (CVE-2019-0203)

ID	Name	Product	Family	Severity
184679	Rocky Linux 8 : subversion:1.10 (RLSA-2020:4712)	Nessus	Rocky Linux Local Security Checks	medium
181002	Oracle Linux 8 : subversion:1.10 (ELSA-2020-4712)	Nessus	Oracle Linux Local Security Checks	medium
180893	Oracle Linux 7 : subversion (ELSA-2020-3972)	Nessus	Oracle Linux Local Security Checks	medium
161576	Ubuntu 18.04 LTS / 20.04 LTS : Subversion vulnerabilities (USN-5445-1)	Nessus	Ubuntu Local Security Checks	high
160167	EulerOS 2.0 SP8 : subversion (EulerOS-SA-2022-1588)	Nessus	Huawei Local Security Checks	medium
154461	NewStart CGSL CORE 5.05 / MAIN 5.05 : subversion Vulnerability (NS-SA-2021-0167)	Nessus	NewStart CGSL Local Security Checks	medium
147258	NewStart CGSL CORE 5.04 / MAIN 5.04 : subversion Vulnerability (NS-SA-2021-0042)	Nessus	NewStart CGSL Local Security Checks	medium
146759	EulerOS 2.0 SP2 : subversion (EulerOS-SA-2021-1365)	Nessus	Huawei Local Security Checks	medium
146143	EulerOS 2.0 SP5 : subversion (EulerOS-SA-2021-1235)	Nessus	Huawei Local Security Checks	medium
145832	CentOS 8 : subversion:1.10 (CESA-2020:4712)	Nessus	CentOS Local Security Checks	medium
145121	EulerOS 2.0 SP3 : subversion (EulerOS-SA-2021-1124)	Nessus	Huawei Local Security Checks	medium
142408	RHEL 8 : subversion:1.10 (RHSA-2020:4712)	Nessus	Red Hat Local Security Checks	medium
141947	Amazon Linux 2 : subversion (ALAS-2020-1549)	Nessus	Amazon Linux Local Security Checks	medium
141704	Scientific Linux Security Update : subversion on SL7.x x86_64 (20201001)	Nessus	Scientific Linux Local Security Checks	medium
141598	CentOS 7 : subversion (RHSA-2020:3972)	Nessus	CentOS Local Security Checks	medium
141013	RHEL 7 : subversion (RHSA-2020:3972)	Nessus	Red Hat Local Security Checks	medium
130610	Amazon Linux AMI : subversion (ALAS-2019-1317)	Nessus	Amazon Linux Local Security Checks	high
130117	Photon OS 2.0: Subversion PHSA-2019-2.0-0182	Nessus	PhotonOS Local Security Checks	high
130104	Photon OS 3.0: Subversion PHSA-2019-3.0-0035	Nessus	PhotonOS Local Security Checks	high
128395	Debian DLA-1903-1 : subversion security update	Nessus	Debian Local Security Checks	high
128002	openSUSE Security Update : subversion (openSUSE-2019-1910)	Nessus	SuSE Local Security Checks	high
127799	Ubuntu 16.04 LTS : Subversion vulnerabilities (USN-4082-1)	Nessus	Ubuntu Local Security Checks	high
127760	SUSE SLED15 / SLES15 Security Update : subversion (SUSE-SU-2019:2031-1)	Nessus	SuSE Local Security Checks	high
127538	Fedora 30 : subversion (2019-f6bc68e455)	Nessus	Fedora Local Security Checks	high
127486	Debian DSA-4490-1 : subversion - security update	Nessus	Debian Local Security Checks	high
127137	Apache Subversion < 1.9.11 / 1.10.x < 1.10.5 / 1.11.x / 1.12.x < 1.12.1 Multiple Vulnerabilities	Nessus	Windows	high

Detections

Analytics

CVE-2018-11782

medium

Tenable Plugins

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

high

high

high

high

high

high

high

high

high

high