Apache has released Subversion 1.9.7 today (August 10), fixing a security issue: https://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%3C2fefe468-7d41-11e7-aea1-9312c6089150%40apache.org%3E http://svn.apache.org/repos/asf/subversion/tags/1.9.7/CHANGES 1.8.19 also fixes the same issue: http://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%3C8760dvl2j6.fsf%40codematters.co.uk%3E http://svn.apache.org/repos/asf/subversion/tags/1.8.19/CHANGES Updated packages uploaded for Mageia 5, Mageia 6, and Cauldron. Advisory: ======================== Updated subversion packages fix security vulnerability: A Subversion client sometimes connects to URLs provided by the repository. A maliciously constructed svn+ssh:// URL would cause Subversion clients to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server (CVE-2017-9800). References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9800 https://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%3C2fefe468-7d41-11e7-aea1-9312c6089150%40apache.org%3E http://svn.apache.org/repos/asf/subversion/tags/1.9.7/CHANGES http://mail-archives.apache.org/mod_mbox/subversion-announce/201708.mbox/%3C8760dvl2j6.fsf%40codematters.co.uk%3E http://svn.apache.org/repos/asf/subversion/tags/1.8.19/CHANGES http://subversion.apache.org/security/CVE-2017-9800-advisory.txt ======================== Updated packages in core/updates_testing: ======================== subversion-1.8.19-1.mga5 subversion-doc-1.8.19-1.mga5 libsvn0-1.8.19-1.mga5 libsvn-gnome-keyring0-1.8.19-1.mga5 libsvn-kwallet0-1.8.19-1.mga5 subversion-server-1.8.19-1.mga5 subversion-tools-1.8.19-1.mga5 python-svn-1.8.19-1.mga5 ruby-svn-1.8.19-1.mga5 libsvnjavahl1-1.8.19-1.mga5 svn-javahl-1.8.19-1.mga5 perl-SVN-1.8.19-1.mga5 subversion-kwallet-devel-1.8.19-1.mga5 subversion-gnome-keyring-devel-1.8.19-1.mga5 perl-svn-devel-1.8.19-1.mga5 python-svn-devel-1.8.19-1.mga5 ruby-svn-devel-1.8.19-1.mga5 subversion-devel-1.8.19-1.mga5 apache-mod_dav_svn-1.8.19-1.mga5 subversion-1.9.7-1.mga6 subversion-doc-1.9.7-1.mga6 libsvn0-1.9.7-1.mga6 libsvn-gnome-keyring0-1.9.7-1.mga6 subversion-server-1.9.7-1.mga6 subversion-tools-1.9.7-1.mga6 python-svn-1.9.7-1.mga6 ruby-svn-1.9.7-1.mga6 libsvnjavahl1-1.9.7-1.mga6 svn-javahl-1.9.7-1.mga6 perl-SVN-1.9.7-1.mga6 subversion-gnome-keyring-devel-1.9.7-1.mga6 perl-svn-devel-1.9.7-1.mga6 python-svn-devel-1.9.7-1.mga6 ruby-svn-devel-1.9.7-1.mga6 subversion-devel-1.9.7-1.mga6 apache-mod_dav_svn-1.9.7-1.mga6 from SRPMS: subversion-1.8.19-1.mga5.src.rpm subversion-1.9.7-1.mga6.src.rpm
Testing procedure: https://bugs.mageia.org/show_bug.cgi?id=14826#c2
Whiteboard: (none) => MGA5TOO has_procedure
Installed and tested without issues. Tested with local and remote repositories, new and existing repositories. $ rpm -qa | egrep -i 'lib(64)?svn|perl-svn|subversion' | sort lib64svn0-1.8.19-1.mga5 perl-SVN-1.8.19-1.mga5 subversion-1.8.19-1.mga5 subversion-tools-1.8.19-1.mga5
Whiteboard: MGA5TOO has_procedure => MGA5TOO has_procedure MGA5-64-OKCC: (none) => mageia
Whiteboard: MGA5TOO has_procedure MGA5-64-OK => MGA5TOO has_procedure MGA5-64-OK advisoryCC: (none) => lewyssmith
mga6 x86_64 Installed all the packages: # rpm -qa | egrep -i 'svn|subversion' | grep -v bcel | grep -v atin | sort apache-mod_dav_svn-1.9.7-1.mga6 lib64svn0-1.9.7-1.mga6 lib64svn-gnome-keyring0-1.9.7-1.mga6 lib64svnjavahl1-1.9.7-1.mga6 perl-SVN-1.9.7-1.mga6 perl-svn-devel-1.9.7-1.mga6 python-svn-1.9.7-1.mga6 python-svn-devel-1.9.7-1.mga6 ruby-svn-1.9.7-1.mga6 ruby-svn-devel-1.9.7-1.mga6 subversion-1.9.7-1.mga6 subversion-devel-1.9.7-1.mga6 subversion-doc-1.9.7-1.mga6 subversion-gnome-keyring-devel-1.9.7-1.mga6 subversion-server-1.9.7-1.mga6 subversion-tools-1.9.7-1.mga6 svn-javahl-1.9.7-1.mga6 Repeating the steps of previous testers to create a dummy SVN repository: $ svnadmin create --fs-type fsfs /home/lcl/svn $ ls -l ~/svn total 24 drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 conf/ drwxr-sr-x 6 lcl lcl 4096 Aug 16 15:33 db/ -r--r--r-- 1 lcl lcl 2 Aug 16 15:33 format drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 hooks/ drwxr-xr-x 2 lcl lcl 4096 Aug 16 15:33 locks/ -rw-r--r-- 1 lcl lcl 246 Aug 16 15:33 README.txt $ mkdir qa/project $ cd qa/project $ mkdir bin src doc $ echo test > doc/index.html $ echo whatever > src/Makefile $ svn import /home/lcl/qa/project/ file:///home/lcl/svn/project/trunk -m 'Initial import' Adding bin Adding doc Adding doc/index.html Adding src Adding src/Makefile Committing transaction... Committed revision 1. $ rm -rf project $ cd $ svn checkout file:///home/lcl/svn/project A project/trunk A project/trunk/bin A project/trunk/doc A project/trunk/doc/index.html A project/trunk/src A project/trunk/src/Makefile Checked out revision 1. Could not proceed with the apache demo: The system geography has changed a little since Claire and Dave's tests. The httpd modules configurations are now at /etc/httpd/conf/modules.d but there is no 46_mod_dav_svn.conf. I hesitate to modify 10_mod_dav_svn.conf because that seems to be concerned solely with setting up load module links. Does anybody have any idea what file needs to be modified now or if there is a replacement for 46_mod_dav_svn.conf? Or maybe it needs to be generated somehow? Creating the file myself with this stanza: ----------------------------- <IfModule mod_dav_svn.c> <Location /svn/repos> DAV svn SVNPath /home/lcl/svn </Location> </IfModule> ---------------------------- did the trick. Restarting httpd and pointing firefox at http://localhost/svn/repos brought up a page with: "repos - Revision 1: project project/ The dummy project could be followed down the links. This is as far as it goes. No PoC available. Thanks to Claire, Dave, David, Herman and PC LX for tips on all this. Just noticed Dave's pointer to /etc/httpd/conf/conf.d/subversion.conf. Ah well.
CC: (none) => tarazed25
Whiteboard: MGA5TOO has_procedure MGA5-64-OK advisory => MGA5TOO has_procedure MGA5-64-OK advisory MGA6-64-OK
And thanks to Len for your usual persistant testing! Validating as this has a 64-bit OK per release.
Keywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. http://advisories.mageia.org/MGASA-2017-0273.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED