CVE-2022-24070: apache software foundation apache subversion Use After Free

CVSS: 7.5v3.1HighModified

AliasesALPINE-CVE-2022-24070RHSA-2022:2222RHSA-2022:2234+7 more

Published 12-04-2022Last modified 03-08-2024

Vulnerability summary

CVE-2022-24070 is a high (CVSS 7.5) Use After Free vulnerability in apache software foundation apache subversion. EPSS estimates a 9.47% chance of exploitation in the next 30 days, higher than 95.3% of scored vulnerabilities.

Overall risk

32/100

0100

Medium · default modelHow is this calculated?

CVSS score

7.5/10

010

High · v3.1 (NVD)

EPSS score

9.47%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 7 · Related 5

DSA-5119-1 MGASA-2022-0140 SUSE-SU-2022:1161-1 SUSE-SU-2022:1162-1 SUSE-SU-2022:1483-1 USN-5372-1+1 more

Timeline

12-04-2022
PublishedVulnerability first disclosed.
03-08-2024
Last modifiedVulnerability information updated.

Description

Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.

CVSS metrics

6 scores · 5 sources · 2 versions

v3.17.5v2.05.0

EPSS trend

Probability

9.47%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 9.47% on 19-09-2026

19-09-202619-10-2026

EPSS score

9.47%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Redhat25 products

libserf< 0:1.3.9-9.module+el8.3.0+6671+2675c974 | < 0:1.3.9-9.module+el8.2.0+9887+08558108 | < 0:1.3.9-9.module+el8.1.0+9889+0a9c19c4 | < 0:1.3.9-9.module+el8.4.0+8637+d3bad2c2
libserf-debuginfo< 0:1.3.9-9.module+el8.3.0+6671+2675c974 | < 0:1.3.9-9.module+el8.2.0+9887+08558108 | < 0:1.3.9-9.module+el8.1.0+9889+0a9c19c4 | < 0:1.3.9-9.module+el8.4.0+8637+d3bad2c2
libserf-debugsource< 0:1.3.9-9.module+el8.3.0+6671+2675c974 | < 0:1.3.9-9.module+el8.2.0+9887+08558108 | < 0:1.3.9-9.module+el8.1.0+9889+0a9c19c4 | < 0:1.3.9-9.module+el8.4.0+8637+d3bad2c2
mod_dav_svn< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
mod_dav_svn-debuginfo< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15

python3-subversion< 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
python3-subversion-debuginfo< 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-debuginfo< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-debugsource< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-devel< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-devel-debuginfo< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-gnome< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-gnome-debuginfo< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-javahl< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-libs< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-libs-debuginfo< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-perl< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-perl-debuginfo< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-ruby-debuginfo< 0:1.14.1-5.el9_0
subversion-tools< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
subversion-tools-debuginfo< 0:1.10.2-5.module+el8.4.0+15158+80ea2a4d | < 0:1.10.2-5.module+el8.6.0+15157+188c9801 | < 0:1.10.2-3.module+el8.2.0+15168+f36597c9 | < 0:1.10.2-3.module+el8.1.0+15169+c14f14c4 | < 0:1.14.1-5.el9_0 | < 0:1.14.1-2.module+el8.4.0+9885+61c1c622 | < 0:1.14.1-2.module+el8.6.0+15201+2f551d15
utf8proc< 0:2.1.1-5.module+el8.3.0+6671+2675c974 | < 0:2.1.1-5.module+el8.2.0+9887+08558108 | < 0:2.1.1-5.module+el8.1.0+9889+0a9c19c4 | < 0:2.1.1-5.module+el8.4.0+8637+d3bad2c2
utf8proc-debuginfo< 0:2.1.1-5.module+el8.3.0+6671+2675c974 | < 0:2.1.1-5.module+el8.2.0+9887+08558108 | < 0:2.1.1-5.module+el8.1.0+9889+0a9c19c4 | < 0:2.1.1-5.module+el8.4.0+8637+d3bad2c2
utf8proc-debugsource< 0:2.1.1-5.module+el8.3.0+6671+2675c974 | < 0:2.1.1-5.module+el8.2.0+9887+08558108 | < 0:2.1.1-5.module+el8.1.0+9889+0a9c19c4 | < 0:2.1.1-5.module+el8.4.0+8637+d3bad2c2

Show all 25

Debian2 products

subversion< 1.14.2-1
debian_linuxEOL10.0 | 11.0

Alpine1 product

subversion≥ 1.10.0, < 1.14.2-r0

Apache1 product

subversion≥ 1.10.0, < 1.10.8 | ≥ 1.14.0, < 1.14.2

Apache software foundation1 product

apache subversionEOL1.10.0 to 1.14.1

Apple1 product

macos≥ 12.0, < 12.5

Fedoraproject1 product

fedoraEOL35 | 36

Ubuntu1 product

subversion< 1.13.0-3ubuntu0.1 | < 1.14.1-3ubuntu0.22.04.1

8 vendors · 33 products

References

33 links

issues.apache.org/jira/browse/SVN-4880X Refsource MISCIssue TrackingVendor Advisory
bz.apache.org/bugzilla/show_bug.cgi?id=65861X Refsource MISCIssue TrackingVendor Advisory
cwiki.apache.org/confluence/display/HTTPD/ModuleLifeX Refsource MISCVendor Advisory
www.debian.org/security/2022/dsa-5119Vendor AdvisoryX Refsource DEBIANThird Party Advisory
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
lists.fedoraproject.org/archives/…Vendor AdvisoryX Refsource FEDORA
support.apple.com/kb/HT213345X Refsource CONFIRMThird Party Advisory
seclists.org/fulldisclosure/2022/Jul/18Mailing ListX Refsource FULLDISCThird Party Advisory
security.alpinelinux.org/vuln/CVE-2022-24070Advisory
access.redhat.com/errata/RHSA-2022:2222Advisory

Show all 33 references

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities