Security update for subversion SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2017:2163-1 Final 1 1 2017-08-14T12:00:42Z current 2017-08-14T12:00:42Z 2017-08-14T12:00:42Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for subversion This update for subversion fixes the following issue: - CVE-2016-8734: Unrestricted XML entity expansion in mod_dontdothat and Subversion clients using http(s):// (bsc#1011552). - CVE-2017-9800: client code execution via argument injection in SSH URL (bnc#1051362) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). sdksp4-subversion-13230,slestso13-subversion-13230 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2017/suse-su-20172163-1/ Link for SUSE-SU-2017:2163-1 https://lists.opensuse.org/opensuse-security-announce/2017-08/msg00045.html E-Mail link for SUSE-SU-2017:2163-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1011552 SUSE Bug 1011552 https://bugzilla.suse.com/1051362 SUSE Bug 1051362 https://www.suse.com/security/cve/CVE-2016-8734/ SUSE CVE CVE-2016-8734 page https://www.suse.com/security/cve/CVE-2017-9800/ SUSE CVE CVE-2017-9800 page SUSE Linux Enterprise Software Development Kit 11 SP4 SUSE Studio Onsite 1.3 subversion-1.6.17-1.36.9.1 subversion-devel-1.6.17-1.36.9.1 subversion-perl-1.6.17-1.36.9.1 subversion-python-1.6.17-1.36.9.1 subversion-server-1.6.17-1.36.9.1 subversion-tools-1.6.17-1.36.9.1 subversion-1.6.17-1.36.9.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 subversion-devel-1.6.17-1.36.9.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 subversion-perl-1.6.17-1.36.9.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 subversion-python-1.6.17-1.36.9.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 subversion-server-1.6.17-1.36.9.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 subversion-tools-1.6.17-1.36.9.1 as a component of SUSE Linux Enterprise Software Development Kit 11 SP4 subversion-1.6.17-1.36.9.1 as a component of SUSE Studio Onsite 1.3 Apache Subversion's mod_dontdothat module and HTTP clients 1.4.0 through 1.8.16, and 1.9.0 through 1.9.4 are vulnerable to a denial-of-service attack caused by exponential XML entity expansion. The attack can cause the targeted process to consume an excessive amount of CPU resources or memory. CVE-2016-8734 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-devel-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-perl-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-python-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-server-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-tools-1.6.17-1.36.9.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.36.9.1 important 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172163-1/ https://www.suse.com/security/cve/CVE-2016-8734.html CVE-2016-8734 https://bugzilla.suse.com/1011552 SUSE Bug 1011552 A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://. CVE-2017-9800 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-devel-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-perl-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-python-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-server-1.6.17-1.36.9.1 SUSE Linux Enterprise Software Development Kit 11 SP4:subversion-tools-1.6.17-1.36.9.1 SUSE Studio Onsite 1.3:subversion-1.6.17-1.36.9.1 important 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2017/suse-su-20172163-1/ https://www.suse.com/security/cve/CVE-2017-9800.html CVE-2017-9800 https://bugzilla.suse.com/1051362 SUSE Bug 1051362 https://bugzilla.suse.com/1052481 SUSE Bug 1052481 https://bugzilla.suse.com/1052696 SUSE Bug 1052696 https://bugzilla.suse.com/1052932 SUSE Bug 1052932 https://bugzilla.suse.com/1053364 SUSE Bug 1053364 https://bugzilla.suse.com/1054653 SUSE Bug 1054653 https://bugzilla.suse.com/1066430 SUSE Bug 1066430 https://bugzilla.suse.com/1071709 SUSE Bug 1071709 https://bugzilla.suse.com/1128150 SUSE Bug 1128150