Bug 1033995 – CVE-2013-4505 subversion: mod_dontdothat does not block requests from certain clients

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1033995 - (CVE-2013-4505) CVE-2013-4505 subversion: mod_dontdothat does not block requests from certain clients

Summary:	CVE-2013-4505 subversion: mod_dontdothat does not block requests from certain...

Status:	CLOSED ERRATA

Aliases:	CVE-2013-4505

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	low Severity low
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=low,public=20131125,reported=2...
Keywords:	Security

Depends On:	1033452 1034377
Blocks:	1033435
	Show dependency tree / graph

Reported:	2013-11-24 21:15 EST by Murray McAllister
Modified:	2015-10-15 14:06 EDT (History)
CC List:	6 users (show)

See Also:
Fixed In Version:	subversion 1.7.14, subversion 1.8.5
Doc Type:	Bug Fix
Doc Text:
Story Points:	---
Clone Of:
Environment:
Last Closed:	2013-12-11 05:20:17 EST
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Groups: None (edit)

Description Murray McAllister 2013-11-24 21:15:58 EST

It was found that mod_dontdothat did not block requests from certain clients (such as Serf-based clients). This could allow a client to bypass intended mod_dontdothat restrictions and use more resources on the server than expected. This issue affected mod_dontdothat versions 1.4.0 to 1.7.13, and 1.8.0 to 1.8.4. It has been corrected in versions 1.7.14 and 1.8.5.

mod_dontdothat is included in the subversion sources for Red Hat Enterprise Linux 5 and 6; however, it is not built and shipped for those products, leaving them unaffected by this flaw.

Acknowledgements:

Red Hat would like to thank the Apache Subversion project for reporting this issue. Upstream acknowledges Ben Reser as the original reporter.

Comment 2 Vincent Danen 2013-11-25 12:17:15 EST

External References:

http://subversion.apache.org/security/CVE-2013-4505-advisory.txt

Comment 3 Vincent Danen 2013-11-25 12:21:24 EST

Created subversion tracking bugs for this issue:

Affects: fedora-all [bug 1034377]

Comment 4 Murray McAllister 2013-11-26 00:01:04 EST

Statement:

Not vulnerable. This issue did not affect the versions of Subversion in Red Hat Enterprise Linux 5 and 6.

Comment 5 Fedora Update System 2013-12-10 21:00:07 EST

subversion-1.7.14-1.fc19 has been pushed to the Fedora 19 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2013-12-10 21:00:34 EST

subversion-1.7.14-1.fc18 has been pushed to the Fedora 18 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Fedora Update System 2013-12-31 14:02:52 EST

subversion-1.8.5-2.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Note You need to log in before you can comment on or make changes to this bug.