This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-17525 →

DEBIAN-CVE-2020-17525

Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a cl...

Original description

The description as published by the source.

Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 subversion

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1"}]}]

Debian:13 subversion

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1"}]}]

Debian:14 subversion

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.14.1-1"}]}]

References

advisory security-tracker.debian.org