It was found that commiting a file with the same SHA-1 hash as a file already in the repository would break the repository.
Created subversion tracking bugs for this issue:
Affects: fedora-all [bug 1429939]
If you have a Subversion repository which accepts commits from untrusted users, installing the following script as a commit hook will reject files which correspond to known SHA-1 collisions.
Further measures to protect the repository or recover from a malicious commit are described in this mailing list post:
subversion-1.6 is not impacted as badly by this issue because it does not include the `enable-rep-sharing` feature. If two colliding files are committed, they can both be checked out correctly. On subversion-1.7 this is not the case unless `enable-rep-sharing` has been set to `false` in the repository configuration.
This issue does not appear to cause any irrecoverable damage to the affected repository. Downstream components such as trac can be adversely affected until one of the colliding files is removed.
Red Hat Product Security has rated this issue as having Moderate security impact. This issue is not currently planned to be addressed in future updates. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.