USN-3388-1: subversion Ubuntu
Vulnerability summary
USN-3388-1 is a vulnerability in subversion Ubuntu with no CVSS score yet.
Advisory lineage
Upstream 3 · Downstream 0 · Related 3Timeline
- 11-08-2017PublishedVulnerability first disclosed.
- 22-04-2026Last modifiedVulnerability information updated.
Description
subversion vulnerabilities Joern Schneeweisz discovered that Subversion did not properly handle host names in 'svn+ssh://' URLs. A remote attacker could use this to construct a subversion repository that when accessed could run arbitrary code with the privileges of the user. (CVE-2017-9800) Daniel Shahaf and James McCoy discovered that Subversion did not properly verify realms when using Cyrus SASL authentication. A remote attacker could use this to possibly bypass intended access restrictions. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-2167) Florian Weimer discovered that Subversion clients did not properly restrict XML entity expansion when accessing http(s):// URLs. A remote attacker could use this to cause a denial of service. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. (CVE-2016-8734)
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Ubuntu1 product
- subversion< 1.8.8-1ubuntu3.3 | < 1.9.3-2ubuntu1.1
1 vendor · 1 product