Bug 1429936
| Summary: | subversion: SHA-1 collision causes repository breakage | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Andrej Nemec <anemec> |
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> |
| Status: | CLOSED WONTFIX | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | unspecified | CC: | dmoppert, jorton, vanmeeuwen+fedora |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | subversion 1.8.18, subversion 1.9.6 | Doc Type: | If docs needed, set a value |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2019-06-08 03:08:47 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 1429939 | ||
| Bug Blocks: | 1429938 | ||
|
Description
Andrej Nemec
2017-03-07 14:29:42 UTC
Created subversion tracking bugs for this issue: Affects: fedora-all [bug 1429939] Mitigation: If you have a Subversion repository which accepts commits from untrusted users, installing the following script as a commit hook will reject files which correspond to known SHA-1 collisions. https://svn.apache.org/viewvc/subversion/trunk/tools/hook-scripts/reject-known-sha1-collisions.sh?view=log Further measures to protect the repository or recover from a malicious commit are described in this mailing list post: https://svn.haxx.se/dev/archive-2017-02/0174.shtml subversion-1.6 is not impacted as badly by this issue because it does not include the `enable-rep-sharing` feature. If two colliding files are committed, they can both be checked out correctly. On subversion-1.7 this is not the case unless `enable-rep-sharing` has been set to `false` in the repository configuration. This issue does not appear to cause any irrecoverable damage to the affected repository. Downstream components such as trac can be adversely affected until one of the colliding files is removed. Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/. External References: https://subversion.apache.org/security/sha1-advisory.txt |