Bug 2074772 (CVE-2022-24070)

Summary: CVE-2022-24070 subversion: Subversion's mod_dav_svn is vulnerable to memory corruption
Product: [Other] Security Response Reporter: Avinash Hanwate <ahanwate>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: jorton, rlescak, vanmeeuwen+fedora
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: subversion 1.14.2, subversion 1.10.8, subversion 1.15 Doc Type: If docs needed, set a value
Doc Text:
A use-after-free vulnerability was found in Subversion in the mod_dav_svn Apache HTTP server (HTTPd) module. While looking up path-based authorization (authz) rules, multiple calls to the post_config hook can invalidate cached pointers to object-pools, which Subversion subsequently uses. This issue crashes the single HTTPd worker thread or the entire HTTPd server process, depending on the configuration of the Apache HTTPd server.
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-07-02 00:42:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2074773, 2076555, 2076556, 2076557, 2076558, 2076559, 2076560, 2076561, 2076562, 2076563, 2076564, 2076565, 2076566, 2077476, 2077477    
Bug Blocks: 2074782    

Description Avinash Hanwate 2022-04-13 04:49:27 UTC
Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.

Comment 1 Avinash Hanwate 2022-04-13 04:49:48 UTC
Created subversion tracking bugs for this issue:

Affects: fedora-all [bug 2074773]

Comment 2 Mauro Matteo Cascella 2022-04-19 10:26:39 UTC
Security advisory: https://subversion.apache.org/security/CVE-2022-24070-advisory.txt.

Comment 3 Mauro Matteo Cascella 2022-04-19 10:37:21 UTC
Upstream issue:
https://issues.apache.org/jira/browse/SVN-4880

Upstream fix:
https://svn.apache.org/viewvc?view=revision&revision=1894734

Comment 7 errata-xmlrpc 2022-05-11 21:29:23 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:2222 https://access.redhat.com/errata/RHSA-2022:2222

Comment 8 errata-xmlrpc 2022-05-12 14:00:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions

Via RHSA-2022:2237 https://access.redhat.com/errata/RHSA-2022:2237

Comment 9 errata-xmlrpc 2022-05-12 15:47:27 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:2234 https://access.redhat.com/errata/RHSA-2022:2234

Comment 10 errata-xmlrpc 2022-05-12 23:14:45 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.2 Extended Update Support

Via RHSA-2022:2236 https://access.redhat.com/errata/RHSA-2022:2236

Comment 11 errata-xmlrpc 2022-05-18 01:28:15 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2022:4591 https://access.redhat.com/errata/RHSA-2022:4591

Comment 12 errata-xmlrpc 2022-05-24 08:30:55 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Extended Update Support

Via RHSA-2022:4722 https://access.redhat.com/errata/RHSA-2022:4722

Comment 13 errata-xmlrpc 2022-06-08 09:55:24 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2022:4941 https://access.redhat.com/errata/RHSA-2022:4941

Comment 14 Product Security DevOps Team 2022-07-02 00:42:16 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-24070