Security update for subversion SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2019:2031-1 Final 1 1 2019-07-31T16:36:47Z current 2019-07-31T16:36:47Z 2019-07-31T16:36:47Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for subversion This update for subversion to version 1.10.6 fixes the following issues: Security issues fixed: - CVE-2018-11782: Fixed a remote denial of service in svnserve 'get-deleted-rev' (bsc#1142743). - CVE-2019-0203: Fixed a remote, unauthenticated denial of service in svnserve (bsc#1142721). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2019-2031,SUSE-SLE-Module-Basesystem-15-2019-2031,SUSE-SLE-Module-Basesystem-15-SP1-2019-2031,SUSE-SLE-Module-Development-Tools-15-2019-2031,SUSE-SLE-Module-Development-Tools-15-SP1-2019-2031,SUSE-SLE-Module-Development-Tools-OBS-15-2019-2031,SUSE-SLE-Module-Development-Tools-OBS-15-SP1-2019-2031,SUSE-SLE-Module-Server-Applications-15-2019-2031,SUSE-SLE-Module-Server-Applications-15-SP1-2019-2031 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2019/suse-su-20192031-1/ Link for SUSE-SU-2019:2031-1 https://lists.suse.com/pipermail/sle-security-updates/2019-July/005766.html E-Mail link for SUSE-SU-2019:2031-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1142721 SUSE Bug 1142721 https://bugzilla.suse.com/1142743 SUSE Bug 1142743 https://www.suse.com/security/cve/CVE-2018-11782/ SUSE CVE CVE-2018-11782 page https://www.suse.com/security/cve/CVE-2019-0203/ SUSE CVE CVE-2019-0203 page SUSE Linux Enterprise Module for Basesystem 15 SUSE Linux Enterprise Module for Basesystem 15 SP1 SUSE Linux Enterprise Module for Development Tools 15 SUSE Linux Enterprise Module for Development Tools 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SUSE Linux Enterprise Module for Server Applications 15 SP1 libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.2 subversion-1.10.6-3.6.2 subversion-bash-completion-1.10.6-3.6.2 subversion-devel-1.10.6-3.6.2 subversion-perl-1.10.6-3.6.2 subversion-python-1.10.6-3.6.2 subversion-python-ctypes-1.10.6-3.6.2 subversion-ruby-1.10.6-3.6.2 subversion-server-1.10.6-3.6.2 subversion-tools-1.10.6-3.6.2 subversion-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 subversion-devel-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 subversion-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 subversion-devel-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Basesystem 15 SP1 subversion-bash-completion-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 subversion-perl-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 subversion-python-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 subversion-tools-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 subversion-bash-completion-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP1 subversion-perl-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP1 subversion-python-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP1 subversion-tools-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Development Tools 15 SP1 subversion-server-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 subversion-server-1.10.6-3.6.2 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP1 In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a well-formed read-only request produces a particular answer. This can lead to disruption for users of the server. CVE-2018-11782 SUSE Linux Enterprise Module for Basesystem 15 SP1:subversion-1.10.6-3.6.2 SUSE Linux Enterprise Module for Basesystem 15 SP1:subversion-devel-1.10.6-3.6.2 SUSE Linux Enterprise Module for Basesystem 15:subversion-1.10.6-3.6.2 SUSE Linux Enterprise Module for Basesystem 15:subversion-devel-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15 SP1:subversion-bash-completion-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15 SP1:subversion-perl-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15 SP1:subversion-python-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15 SP1:subversion-tools-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15:subversion-bash-completion-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15:subversion-perl-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15:subversion-python-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15:subversion-tools-1.10.6-3.6.2 SUSE Linux Enterprise Module for Server Applications 15 SP1:subversion-server-1.10.6-3.6.2 SUSE Linux Enterprise Module for Server Applications 15:subversion-server-1.10.6-3.6.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192031-1/ https://www.suse.com/security/cve/CVE-2018-11782.html CVE-2018-11782 https://bugzilla.suse.com/1142743 SUSE Bug 1142743 In Apache Subversion versions up to and including 1.9.10, 1.10.4, 1.12.0, Subversion's svnserve server process may exit when a client sends certain sequences of protocol commands. This can lead to disruption for users of the server. CVE-2019-0203 SUSE Linux Enterprise Module for Basesystem 15 SP1:subversion-1.10.6-3.6.2 SUSE Linux Enterprise Module for Basesystem 15 SP1:subversion-devel-1.10.6-3.6.2 SUSE Linux Enterprise Module for Basesystem 15:subversion-1.10.6-3.6.2 SUSE Linux Enterprise Module for Basesystem 15:subversion-devel-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15 SP1:subversion-bash-completion-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15 SP1:subversion-perl-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15 SP1:subversion-python-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15 SP1:subversion-tools-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15:subversion-bash-completion-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15:subversion-perl-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15:subversion-python-1.10.6-3.6.2 SUSE Linux Enterprise Module for Development Tools 15:subversion-tools-1.10.6-3.6.2 SUSE Linux Enterprise Module for Server Applications 15 SP1:subversion-server-1.10.6-3.6.2 SUSE Linux Enterprise Module for Server Applications 15:subversion-server-1.10.6-3.6.2 important To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2019/suse-su-20192031-1/ https://www.suse.com/security/cve/CVE-2019-0203.html CVE-2019-0203 https://bugzilla.suse.com/1142721 SUSE Bug 1142721