Detections
Analytics

Alpine: mod_dav_svn, multiple subversion packages, perl-subversion: security update to 1.14.5-r0

high Tenable Cloud Security Plugin ID 425702

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

 - On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's
 executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including
 argument injection and execution of other programs, if a specially crafted command line argument string is
 processed. All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows
 platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue.
 Subversion is not affected on UNIX-like platforms. (CVE-2024-45720)

 - Insufficient validation of filenames against control characters in Apache Subversion repositories served
 via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to
 disruption for users of the repository. All versions of Subversion up to and including Subversion 1.14.4
 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5,
 which fixes this issue. Repositories served via other access methods are not affected. (CVE-2024-46901)

See Also

https://security.alpinelinux.org/vuln/CVE-2024-45720

https://security.alpinelinux.org/vuln/CVE-2024-46901

Plugin Details

Severity: High

ID: 425702

Version: Revision 1.9

Type: Local

Published: 4/18/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 6.9

Percentile: 96.99

CVSS v2

Risk Factor: Medium

Base Score: 6.8

Temporal Score: 5.3

Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2024-45720

CVSS v3

Risk Factor: High

Base Score: 7.8

Temporal Score: 7

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/9/2024

Reference Information

CVE: CVE-2024-45720, CVE-2024-46901

IAVA: 2024-A-0640