It was found that commiting a file with the same SHA-1 hash as a file already in the repository would break the repository. Upstream bug: https://issues.apache.org/jira/browse/SVN-4673 Upstream patches: https://svn.apache.org/viewvc?view=revision&revision=1785053 https://svn.apache.org/viewvc?view=revision&revision=1785734 https://svn.apache.org/viewvc?view=revision&revision=1785737 https://svn.apache.org/viewvc?view=revision&revision=1785738 https://svn.apache.org/viewvc?view=revision&revision=1785754 References: https://arstechnica.com/security/2017/02/watershed-sha1-collision-just-broke-the-webkit-repository-others-may-follow/ https://lists.webkit.org/pipermail/webkit-dev/2017-February/028795.html
Created subversion tracking bugs for this issue: Affects: fedora-all [bug 1429939]
Mitigation: If you have a Subversion repository which accepts commits from untrusted users, installing the following script as a commit hook will reject files which correspond to known SHA-1 collisions. https://svn.apache.org/viewvc/subversion/trunk/tools/hook-scripts/reject-known-sha1-collisions.sh?view=log Further measures to protect the repository or recover from a malicious commit are described in this mailing list post: https://svn.haxx.se/dev/archive-2017-02/0174.shtml
subversion-1.6 is not impacted as badly by this issue because it does not include the `enable-rep-sharing` feature. If two colliding files are committed, they can both be checked out correctly. On subversion-1.7 this is not the case unless `enable-rep-sharing` has been set to `false` in the repository configuration. This issue does not appear to cause any irrecoverable damage to the affected repository. Downstream components such as trac can be adversely affected until one of the colliding files is removed.
Statement: Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.
External References: https://subversion.apache.org/security/sha1-advisory.txt