Opened 6 months ago

Closed 6 months ago

#14636 closed enhancement (fixed)

subversion-1.14.1 (Security Release)

Reported by: Douglas R. Reno Owned by: Douglas R. Reno
Priority: high Milestone: 10.1
Component: BOOK Version: SVN
Severity: normal Keywords:
Cc:

Description

New point version

Change History (7)

comment:1 by Douglas R. Reno, 6 months ago

Owner: changed from blfs-book to Douglas R. Reno
Status: newassigned

comment:2 by Douglas R. Reno, 6 months ago

From oss-security:

I'm happy to announce the release of Apache Subversion 1.14.1.
Please choose the mirror closest to you by visiting:

    https://subversion.apache.org/download.cgi#recommended-release

This is a stable bugfix and security release of the Apache Subversion
open source version control system.

THIS RELEASE CONTAINS AN IMPORTANT SECURITY FIX:

  CVE-2020-17525
  "Remote unauthenticated denial-of-service in Subversion mod_authz_svn"

The full security advisory for CVE-2020-17525 is available at:
  https://subversion.apache.org/security/CVE-2020-17525-advisory.txt

A brief summary of this advisory follows:

  Subversion's mod_authz_svn module will crash if the server is using
  in-repository authz rules with the AuthzSVNReposRelativeAccessFile
  option and a client sends a request for a non-existing repository URL.

  This can lead to disruption for users of the service.

  We recommend all users to upgrade to the 1.10.7 or 1.14.1 release
  of the Subversion mod_dav_svn server.

  As a workaround, the use of in-repository authz rules files with
  the AuthzSVNReposRelativeAccessFile can be avoided by switching
  to an alternative configuration which fetches an authz rules file
  from the server's filesystem, rather than from an SVN repository.

  This issue was reported by Thomas Åkesson.

SHA-512 checksums are available at:

    https://www.apache.org/dist/subversion/subversion-1.14.1.tar.bz2.sha512
    https://www.apache.org/dist/subversion/subversion-1.14.1.tar.gz.sha512
    https://www.apache.org/dist/subversion/subversion-1.14.1.zip.sha512

PGP Signatures are available at:

    https://www.apache.org/dist/subversion/subversion-1.14.1.tar.bz2.asc
    https://www.apache.org/dist/subversion/subversion-1.14.1.tar.gz.asc
    https://www.apache.org/dist/subversion/subversion-1.14.1.zip.asc

For this release, the following people have provided PGP signatures:

   Stefan Sperling [2048R/4F7DBAA99A59B973] with fingerprint:
    8BC4 DAE0 C5A4 D65F 4044  0107 4F7D BAA9 9A59 B973
   Branko Čibej [4096R/1BCA6586A347943F] with fingerprint:
    BA3C 15B1 337C F0FB 222B  D41A 1BCA 6586 A347 943F
   Johan Corveleyn [4096R/B59CE6D6010C8AAD] with fingerprint:
    8AA2 C10E EAAD 44F9 6972  7AEA B59C E6D6 010C 8AAD

These public keys are available at:

    https://www.apache.org/dist/subversion/subversion-1.14.1.KEYS

Release notes for the 1.14.x release series may be found at:

    https://subversion.apache.org/docs/release-notes/1.14.html

You can find the list of changes between 1.14.1 and earlier versions at:

    https://svn.apache.org/repos/asf/subversion/tags/1.14.1/CHANGES

Questions, comments, and bug reports to users@subversion.apache.org.

Thanks,
- The Subversion Team

--
To unsubscribe, please see:

    https://subversion.apache.org/mailing-lists.html#unsubscribing

comment:3 by Douglas R. Reno, 6 months ago

Apache Security Advisory (https://subversion.apache.org/security/CVE-2020-17525-advisory.txt)

  Remote unauthenticated denial-of-service in Subversion mod_authz_svn.

Summary:
========

  Subversion's mod_authz_svn module will crash if the server is using
  in-repository authz rules with the AuthzSVNReposRelativeAccessFile
  option and a client sends a request for a non-existing repository URL.

  This can lead to disruption for users of the service.

Known vulnerable:
=================

  mod_dav_svn+mod_authz_svn servers 1.9.0 through 1.10.6 (inclusive).
  mod_dav_svn+mod_authz_svn servers 1.11.0 through 1.14.0 (inclusive).

Known fixed:
============

  mod_dav_svn+mod_authz_svn servers 1.14.1
  mod_dav_svn+mod_authz_svn servers 1.10.7

Details:
========

  A null-pointer-dereference has been found in mod_authz_svn that results in
  a remote unauthenticated Denial-of-Service in some server configurations.

  The vulnerability can be triggered by an unauthenticated user if the
  Apache HTTPD server is configured to use an in-repository authz file,
  with configuration directives such as:

    AuthzSVNAccessFile "^/authz"
    AuthzSVNReposRelativeAccessFile "^/authz"

  The problem originates when sending a GET request to a non-existent
  repository. The mod_authz_svn module will attempt to find authz rules
  at a path within the requested SVN repository. Upon constructing this
  path, the function svn_repos_find_root_path will return a NULL pointer
  since the requested repository does not exist on-disk.
  A check for this legitimate NULL pointer condition is missing, which
  results in a segmentation fault when the NULL pointer is used.

  The in-repository authz feature was first introduced in Subversion 1.8:
  https://subversion.apache.org/docs/release-notes/1.8.html#in-repo-authz

  The missing NULL check was first introduced during refactoring of the
  authz code during development work leading up to Subversion 1.9.
  Subversion 1.8 servers are unaffected.

Severity:
=========

  CVSSv3 Base Score: 7.5 (High)

  CVSSv3 Base Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

  Exploitation results in denial of service by crashing the HTTPD worker
  handling the request. The impact of this differs depending on how the
  Apache HTTPD server is configured, including the choice of MPM (Multi-
  Processing-Module). If the worker shares its memory address space with
  the main thread, as is the case with e.g. the Event MPM, the entire
  HTTPD server process will terminate. If the pre-fork MPM is used, the
  worker will terminate but the HTTPD server will stay up, and service
  availability will depend on how frequently the attacker is able to
  send malicious requests which target the vulnerability.

Recommendations:
================

  We recommend all users to upgrade to a known fixed release of the
  Subversion mod_dav_svn server.

  Users who are unable to upgrade may apply the included patches.

  As a workaround, the use of in-repository authz rules files with
  the AuthzSVNReposRelativeAccessFile can be avoided by switching
  to an alternative configuration which fetches an authz rules file
  from the server's filesystem, rather than from an SVN repository.

References:
===========

  CVE-2020-17525 (Subversion)

Reported by:
============

  Thomas Ã…kesson, simonsoft.se

Patches:
========

  Patch for Subversion 1.10, 1.14:

[[[
Index: subversion/libsvn_repos/config_file.c
===================================================================
--- subversion/libsvn_repos/config_file.c	(revision 1883994)
+++ subversion/libsvn_repos/config_file.c	(working copy)
@@ -237,6 +237,10 @@ get_repos_config(svn_stream_t **stream,
     {
       /* Search for a repository in the full path. */
       repos_root_dirent = svn_repos_find_root_path(dirent, scratch_pool);
+      if (repos_root_dirent == NULL)
+        return svn_error_trace(handle_missing_file(stream, checksum, access,
+                                                   url, must_exist,
+                                                   svn_node_none));
 
       /* Attempt to open a repository at repos_root_dirent. */
       SVN_ERR(svn_repos_open3(&access->repos, repos_root_dirent, NULL,
]]]

comment:4 by Douglas R. Reno, 6 months ago

The rest of the CHANGES file:

Version 1.14.1
(10 Feb 2021, from /branches/1.14.x)
 User-visible changes:
  - Client-side improvements and bugfixes:
    * Fix non-deterministic generation of mergeinfo (issue #4862)
    * Fix merge removing a folder with non-inheritable mergeinfo (issue #4859)
    * Do not suggest --help -v for commands which do not support -v (r1882157)
    * Fix invalid SQL quoting in working copy upgrade system (r1879198)
    * Fix problems in human-readable file size formatting (r1878909, -18, -50)
    * Improve an error message from svnmucc (r1877072)
    * Fix 'svn info --xml' gives wrong 'source-right' of conflict (issue #4869)
    * Fix filename encoding/quoting when invoking editor on Windows (r1885953)
    * Convert filename for editor from UTF-8 to the locale's encoding (r1882234)

  - Server-side improvements and bugfixes:
    * Fix authz doesn't combine global and repository rules (issue #4762)
    * Make the hot-backup.py script work with Python 3 (r1878855, r1878859)
    * Fix an uninitialized read in FSFS (r1880374)
    * Make mailer.py work properly with Python 3 (r1884427 et al)
    * Fix a potential NULL dereference in the config file parser (r1886019)

comment:5 by Douglas R. Reno, 6 months ago

I have the update complete, but the tarball is not available from archive.apache.org yet. I'm going to go work on my other updates and check back when I have them done

comment:6 by Douglas R. Reno, 6 months ago

1.14.1 has arrived on archive.apache.org

comment:7 by Douglas R. Reno, 6 months ago

Resolution: fixed
Status: assignedclosed

Fixed at r24210

Note: See TracTickets for help on using tickets.