id	summary	reporter	owner	description	type	status	priority	milestone	component	version	severity	resolution	keywords	cc
9599	subversion-1.9.7	ken@…	ken@…	"Following on from git-2.14.1, subversion-1.9.7 has been released. This fixes CVE-2017-9800, from [https://subversion.apache.org/security/CVE-2017-9800-advisory.txt] :
  Arbitrary code execution on clients through malicious svn+ssh URLs in
  svn:externals and svn:sync-from-url

Summary:
========

  A Subversion client sometimes connects to URLs provided by the repository.
  This happens in two primary cases: during 'checkout', 'export', 'update', and
  'switch', when the tree being downloaded contains svn:externals properties;
  and when using 'svnsync sync' with one URL argument.

  A maliciously constructed svn+ssh:// URL would cause Subversion clients to
  run an arbitrary shell command.  Such a URL could be generated by a malicious
  server, by a malicious user committing to a honest server (to attack another
  user of that server's repositories), or by a proxy server.

  The vulnerability affects all clients, including those that use file://,
  http://, and plain (untunneled) svn://.

  An exploit has been tested.

Known vulnerable:
=================

  Subversion clients 1.0.0 through 1.8.18 (inclusive)
  Subversion clients 1.9.0 through 1.9.6 (inclusive)
  Subversion client 1.10.0-alpha3

  Subversion 1.10.0-alpha1 and 1.10.0-alpha2 are vulnerable,
  however, were never publicly released.

Known fixed:
============

  Subversion 1.8.19
  Subversion 1.9.7

  Patches are available for 1.9, 1.8, 1.6.  The patch for 1.9 applies
  to 1.10.0-alpha3 with an offset.  The patch for 1.8 applies to 1.7
  with an offset.

  Clients that do not have access to an ssh client, and have no custom tunnels
  configured in their runtime configuration area [1], are not vulnerable.

  Clients using Subversion's own runtime module loading for Repository Access
  (RA) modules are not vulnerable if the 'libsvn_ra_svn' module, which provides
  support for the svn+ssh:// and svn:// protocols is removed.

  [1] http://svnbook.red-bean.com/en/1.7/svn.advanced.confarea.html#svn.advanced.confarea.layout
      This link describes Subversion 1.7, but the description is correct for
      all other versions as well.

Details:
========

  (see ""Summary:"" above)

Severity:
=========

  CVSSv3 Base Score: 9.9 (Critical)
  CVSSv3 Base Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:H/RL:O/RC:C

{{{

}}}

When I built 1.9.6 the other week I got a test failure in [023/109] locks-test:
{{{
FAIL:  lt-locks-test 14: lock/unlock when 'write-lock' couldn't be obtained
}}}

I suspect that one might be an issue with either gcc-7.1 or else newer headers, in which case it might might repeat in this version.
"	enhancement	closed	high	8.1	BOOK	SVN	medium	fixed