Description
Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Apache Software Foundation Apache Subversion
1.10.0 to 1.14.1affected
References
- https://issues.apache.org/jira/browse/SVN-4880 ↗
- https://bz.apache.org/bugzilla/show_bug.cgi?id=65861 ↗
- https://cwiki.apache.org/confluence/display/HTTPD/ModuleLife ↗
- https://www.debian.org/security/2022/dsa-5119 ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/ ↗
- https://support.apple.com/kb/HT213345 ↗
- http://seclists.org/fulldisclosure/2022/Jul/18 ↗