Bug 33838 - subversion new security issue CVE-2024-46901
Summary: subversion new security issue CVE-2024-46901
Status: ASSIGNED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 9
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard:
Keywords: advisory, feedback
Depends on:
Blocks:
 
Reported: 2024-12-09 09:29 CET by Nicolas Salguero
Modified: 2024-12-20 01:03 CET (History)
2 users (show)

See Also:
Source RPM: subversion-1.14.2-2.mga9.src.rpm
CVE: CVE-2024-46901
Status comment:


Attachments

Description Nicolas Salguero 2024-12-09 09:29:28 CET
CVE-2024-46901 was announced here:
https://www.openwall.com/lists/oss-security/2024/12/09/1
Nicolas Salguero 2024-12-09 09:30:04 CET

Status comment: (none) => Fixed upstream in 1.14.5
CVE: (none) => CVE-2024-46901
Whiteboard: (none) => MGA9TOO
Source RPM: (none) => subversion-1.14.3-3.mga10.src.rpm, subversion-1.14.2-2.mga9.src.rpm

Comment 1 Lewis Smith 2024-12-09 13:47:09 CET
No one packager in evidence for this, so assigning globally.

Assignee: bugsquad => pkg-bugs

Comment 2 Nicolas Salguero 2024-12-16 14:21:38 CET
Suggested advisory:
========================

The updated packages fix a security vulnerability:

Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. (CVE-2024-46901)

References:
https://www.openwall.com/lists/oss-security/2024/12/09/1
========================

Updated packages in core/updates_testing:
========================
apache-mod_dav_svn-1.14.2-2.1.mga9
lib(64)svn-gnome-keyring0-1.14.2-2.1.mga9
lib(64)svn-kwallet0-1.14.2-2.1.mga9
lib(64)svn0-1.14.2-2.1.mga9
lib(64)svnjavahl1-1.14.2-2.1.mga9
perl-SVN-1.14.2-2.1.mga9
python3-svn-1.14.2-2.1.mga9
subversion-1.14.2-2.1.mga9
subversion-devel-1.14.2-2.1.mga9
subversion-doc-1.14.2-2.1.mga9
subversion-server-1.14.2-2.1.mga9
subversion-tools-1.14.2-2.1.mga9
svn-javahl-1.14.2-2.1.mga9

from SRPM:
subversion-1.14.2-2.1.mga9.src.rpm

Version: Cauldron => 9
Source RPM: subversion-1.14.3-3.mga10.src.rpm, subversion-1.14.2-2.mga9.src.rpm => subversion-1.14.2-2.mga9.src.rpm
Status comment: Fixed upstream in 1.14.5 => (none)
Status: NEW => ASSIGNED
Assignee: pkg-bugs => qa-bugs
Whiteboard: MGA9TOO => (none)

Comment 3 katnatek 2024-12-16 19:24:38 CET
RH x86_64

installing subversion-1.14.2-2.1.mga9.x86_64.rpm lib64svn0-1.14.2-2.1.mga9.x86_64.rpm perl-SVN-1.14.2-2.1.mga9.x86_64.rpm from //home/katnatek/qa-testing/x86_64
Preparing...                     ##################################################################################################
      1/3: lib64svn0             ##################################################################################################
      2/3: subversion            ##################################################################################################
      3/3: perl-SVN              ##################################################################################################
      1/3: removing perl-SVN-2:1.14.2-2.mga9.x86_64
                                 ##################################################################################################
      2/3: removing subversion-2:1.14.2-2.mga9.x86_64
                                 ##################################################################################################

As in https://bugs.mageia.org/show_bug.cgi?id=30274#c2
Used to send advisory
OK for me
      3/3: removing lib64svn0-2:1.14.2-2.mga9.x86_64
                                 ##################################################################################################

Keywords: (none) => advisory

Comment 4 Herman Viaene 2024-12-17 12:18:05 CET
MGA9-64 Plasma Wayland on Compaq H000SB
No installation issues.
Treied to test along lines of bugs 28348, 10895 and 9624
$ svnadmin create --fs-type fsfs /home/tester9/testsvn
[tester9@mach3 testsvn]$ mkdir project
[tester9@mach3 testsvn]$ cd project/
[tester9@mach3 project]$ mkdir bin
[tester9@mach3 project]$ mkdir src
[tester9@mach3 project]$ mkdir doc
[tester9@mach3 project]$ echo test>doc/index.html
[tester9@mach3 project]$ echo stuff>src/Makefile
$ svn import /home/tester9/testsvn/project/ file:///home/tester9/testsvn/project/trunk -m 'Initial import'
Adding         bin
Adding         doc
Adding         doc/index.html
Adding         src
Adding         src/Makefile
Committing transaction...
Committed revision 1.
$ cd ..
$ ls
conf/  db/  format  hooks/  locks/  project/  README.txt
$ rm -rf project
$ ls
conf/  db/  format  hooks/  locks/  README.txt
[tester9@mach3 testsvn]$ svn checkout file:///home/tester9/testsvn/project
A    project/trunk
A    project/trunk/bin
A    project/trunk/doc
A    project/trunk/doc/index.html
A    project/trunk/src
A    project/trunk/src/Makefile
Checked out revision 1.

But then, bug 10895 lists
sudo mc -e /etc/httpd/modules.d/46_mod_dav_svn.conf
but that file does not exist.
Found file /etc/httpd/conf/modules.d/10_mod_dav_snv.conf and added the lines stated in bug 9624 (changed to my own folders) and after restart of httpd, tried to point firefox to the snv repo but get this:

This XML file does not appear to have any style information associated with it. The document tree is shown below.
<D:error>
<C:error/>
<m:human-readable errcode="13"> Could not open the requested SVN filesystem </m:human-readable>
</D:error>

CC: (none) => herman.viaene

Comment 5 Herman Viaene 2024-12-17 13:52:43 CET
Forgot to mention, had to add the EDITOR environment variable asq in previous bugs. Not good.
katnatek 2024-12-18 03:46:05 CET

Keywords: (none) => feedback

Comment 6 PC LX 2024-12-20 01:03:40 CET
Installed and tested without issues.

I only use subversion for legacy repositories so only did some quick tests.
Did not test the apache, java, gnome-keyring0, and kwallet0 packages.

Tested on old repositories and newly created ones.
Tested svnserve and local filesystem repositories.
Tested a bunch of commands: status, info, checkout, commit, diff, ls, update, upgrade, add, move, mkdir, merge, copy, delete.



System: Mageia 9, x86_64, AMD Ryzen 5 5600G with Radeon Graphics using amdgpu driver.



$ uname -a
Linux jupiter 6.6.65-desktop-2.mga9 #1 SMP PREEMPT_DYNAMIC Thu Dec 12 12:42:26 UTC 2024 x86_64 GNU/Linux
$ rpm -qa | grep '1.14.2-2.1' | sort
lib64svn0-1.14.2-2.1.mga9
subversion-1.14.2-2.1.mga9
subversion-server-1.14.2-2.1.mga9
subversion-tools-1.14.2-2.1.mga9

CC: (none) => mageia


Note You need to log in before you can comment on or make changes to this bug.