CVE-2021-28544

12.04.2022, 18:15

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	NIST	4.3 MEDIUM	NETWORK	LOW	LOW	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
apache	CNA	---				---
CVE	ADP	---				---

Base Score

CVSS 3.x

EPSS Score

Percentile: 31%

Vendor	Product	Version
apache	subversion	1.10.0 ≤ 𝑥 ≤ 1.14.1
debian	debian_linux	10.0
debian	debian_linux	11.0
apple	macos	12.0 ≤ 𝑥 < 12.5

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

subversion

bullseye (security)	1.14.1-3+deb11u1 fixed
bullseye	1.14.1-3+deb11u1 fixed
stretch	not-affected
bookworm	1.14.2-4 fixed
sid	1.14.4-2 fixed
trixie	1.14.4-2 fixed

Ubuntu Releases

Ubuntu Product

Codename

subversion

jammy	Fixed 1.14.1-3ubuntu0.22.04.1 released
impish	Fixed 1.14.1-3ubuntu0.1 released
focal	Fixed 1.13.0-3ubuntu0.1 released
bionic	not-affected
xenial	not-affected

Known Exploits!

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://seclists.org/fulldisclosure/2022/Jul/18

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/

https://subversion.apache.org/security/CVE-2021-28544-advisory.txt