Subversion CVE-2021-28544: Authz Path Disclosure via copyfrom Regression

Key Vulnerability Information Summary Vulnerability Overview Vulnerability Name: SVN authz protected copyfrom paths regression Description: Subversion servers, based on configured path authorization (authz) rules, should hide certain "copyfrom" paths, but in reality, these paths are leaked. Affected Versions Vulnerable Versions: - Subversion httpd server: 1.10.0 to 1.14.1 - Subversion svnserve server: 1.10.0 to 1.14.1 Fixed Versions: - Subversion httpd and svnserve servers: 1.14.2 - Subversion httpd and svnserve servers: 1.10.8 Detailed Description Vulnerability Details: When retrieving log messages, the function searches for and reports relevant changes, such as nodes added via copying. When using authz, information about nodes without access permissions should be omitted. If a node in a readable location is copied from an unreadable location, only the readable path should be reported, and the copyfrom path should be ignored. Example: If a file under a private folder is copied to a public folder, a vulnerable server will disclose the private file’s path via , even though its content remains protected. Severity CVSSv3.1 Base Score: 4.3 CVSSv3.1 Base Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N Recommended Actions Users are advised to upgrade to a Subversion server version that fixes this vulnerability. Users unable to upgrade may apply the provided patch. References CVE ID: CVE-2021-28544 Reporter Evgeny Kotkov, visualsvn.com

Goal Reached Thanks to every supporter — we hit 100%!

Subversion CVE-2021-28544: Authz Path Disclosure via copyfrom Regression