| Summary: | subversion new security issue CVE-2017-9800 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | normal | ||
| Priority: | Normal | CC: | lewyssmith, mageia, sysadmin-bugs, tarazed25 |
| Version: | 6 | Keywords: | validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA5TOO has_procedure MGA5-64-OK advisory MGA6-64-OK | ||
| Source RPM: | subversion-1.9.6-1.mga6.src.rpm | CVE: | |
| Status comment: | |||
|
Description
David Walser
2017-08-11 04:02:50 CEST
Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=14826#c2 Whiteboard:
(none) =>
MGA5TOO has_procedure Installed and tested without issues. Tested with local and remote repositories, new and existing repositories. $ rpm -qa | egrep -i 'lib(64)?svn|perl-svn|subversion' | sort lib64svn0-1.8.19-1.mga5 perl-SVN-1.8.19-1.mga5 subversion-1.8.19-1.mga5 subversion-tools-1.8.19-1.mga5 Whiteboard:
MGA5TOO has_procedure =>
MGA5TOO has_procedure MGA5-64-OK
Lewis Smith
2017-08-13 20:17:11 CEST
Whiteboard:
MGA5TOO has_procedure MGA5-64-OK =>
MGA5TOO has_procedure MGA5-64-OK advisory mga6 x86_64
Installed all the packages:
# rpm -qa | egrep -i 'svn|subversion' | grep -v bcel | grep -v atin | sort
apache-mod_dav_svn-1.9.7-1.mga6
lib64svn0-1.9.7-1.mga6
lib64svn-gnome-keyring0-1.9.7-1.mga6
lib64svnjavahl1-1.9.7-1.mga6
perl-SVN-1.9.7-1.mga6
perl-svn-devel-1.9.7-1.mga6
python-svn-1.9.7-1.mga6
python-svn-devel-1.9.7-1.mga6
ruby-svn-1.9.7-1.mga6
ruby-svn-devel-1.9.7-1.mga6
subversion-1.9.7-1.mga6
subversion-devel-1.9.7-1.mga6
subversion-doc-1.9.7-1.mga6
subversion-gnome-keyring-devel-1.9.7-1.mga6
subversion-server-1.9.7-1.mga6
subversion-tools-1.9.7-1.mga6
svn-javahl-1.9.7-1.mga6
Repeating the steps of previous testers to create a dummy SVN repository:
$ svnadmin create --fs-type fsfs /home/lcl/svn
$ ls -l ~/svn
total 24
drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 conf/
drwxr-sr-x 6 lcl lcl 4096 Aug 16 15:33 db/
-r--r--r-- 1 lcl lcl 2 Aug 16 15:33 format
drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 hooks/
drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 locks/
-rw-r--r-- 1 lcl lcl 246 Aug 16 15:33 README.txt
$ mkdir qa/project
$ cd qa/project
$ mkdir bin src doc
$ echo test > doc/index.html
$ echo whatever > src/Makefile
$ svn import /home/lcl/qa/project/ file:///home/lcl/svn/project/trunk -m 'Initial import'
Adding bin
Adding doc
Adding doc/index.html
Adding src
Adding src/Makefile
Committing transaction...
Committed revision 1.
$ rm -rf project
$ cd
$ svn checkout file:///home/lcl/svn/project
A project/trunk
A project/trunk/bin
A project/trunk/doc
A project/trunk/doc/index.html
A project/trunk/src
A project/trunk/src/Makefile
Checked out revision 1.
Could not proceed with the apache demo:
The system geography has changed a little since Claire and Dave's tests.
The httpd modules configurations are now at /etc/httpd/conf/modules.d but there is no 46_mod_dav_svn.conf. I hesitate to modify 10_mod_dav_svn.conf because that seems to be concerned solely with setting up load module links.
Does anybody have any idea what file needs to be modified now or if there is a replacement for 46_mod_dav_svn.conf? Or maybe it needs to be generated somehow?
Creating the file myself with this stanza:
-----------------------------
<IfModule mod_dav_svn.c>
<Location /svn/repos>
DAV svn
SVNPath /home/lcl/svn
</Location>
</IfModule>
----------------------------
did the trick.
Restarting httpd and pointing firefox at http://localhost/svn/repos brought up a page with:
"repos - Revision 1: project
project/
The dummy project could be followed down the links.
This is as far as it goes. No PoC available.
Thanks to Claire, Dave, David, Herman and PC LX for tips on all this.
Just noticed Dave's pointer to /etc/httpd/conf/conf.d/subversion.conf. Ah well.CC:
(none) =>
tarazed25
Len Lawrence
2017-08-16 17:46:00 CEST
Whiteboard:
MGA5TOO has_procedure MGA5-64-OK advisory =>
MGA5TOO has_procedure MGA5-64-OK advisory MGA6-64-OK And thanks to Len for your usual persistant testing! Validating as this has a 64-bit OK per release. Keywords:
(none) =>
validated_update An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0273.html Resolution:
(none) =>
FIXED |