Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.
Created subversion tracking bugs for this issue: Affects: fedora-all [bug 2074773]
Security advisory: https://subversion.apache.org/security/CVE-2022-24070-advisory.txt.
Upstream issue: https://issues.apache.org/jira/browse/SVN-4880 Upstream fix: https://svn.apache.org/viewvc?view=revision&revision=1894734
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:2222 https://access.redhat.com/errata/RHSA-2022:2222
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions Via RHSA-2022:2237 https://access.redhat.com/errata/RHSA-2022:2237
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:2234 https://access.redhat.com/errata/RHSA-2022:2234
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Extended Update Support Via RHSA-2022:2236 https://access.redhat.com/errata/RHSA-2022:2236
This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2022:4591 https://access.redhat.com/errata/RHSA-2022:4591
This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Extended Update Support Via RHSA-2022:4722 https://access.redhat.com/errata/RHSA-2022:4722
This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2022:4941 https://access.redhat.com/errata/RHSA-2022:4941
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2022-24070