mirror of
https://git.yoctoproject.org/poky
synced 2026-04-30 21:32:13 +02:00
766ba72f56
(From OE-Core rev: 3975fe2156d30cc64005e56666f4e88716d5ba27) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
118 lines
4.2 KiB
Diff
118 lines
4.2 KiB
Diff
Upstream-Status: Backport [ https://subversion.apache.org/security/CVE-2020-17525-advisory.txt ]
|
|
CVE: CVE-2020-17525
|
|
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
|
|
|
|
Remote unauthenticated denial-of-service in Subversion mod_authz_svn.
|
|
|
|
Summary:
|
|
========
|
|
|
|
Subversion's mod_authz_svn module will crash if the server is using
|
|
in-repository authz rules with the AuthzSVNReposRelativeAccessFile
|
|
option and a client sends a request for a non-existing repository URL.
|
|
|
|
This can lead to disruption for users of the service.
|
|
|
|
Known vulnerable:
|
|
=================
|
|
|
|
mod_dav_svn+mod_authz_svn servers 1.9.0 through 1.10.6 (inclusive).
|
|
mod_dav_svn+mod_authz_svn servers 1.11.0 through 1.14.0 (inclusive).
|
|
|
|
Known fixed:
|
|
============
|
|
|
|
mod_dav_svn+mod_authz_svn servers 1.14.1
|
|
mod_dav_svn+mod_authz_svn servers 1.10.7
|
|
|
|
Details:
|
|
========
|
|
|
|
A null-pointer-dereference has been found in mod_authz_svn that results in
|
|
a remote unauthenticated Denial-of-Service in some server configurations.
|
|
|
|
The vulnerability can be triggered by an unauthenticated user if the
|
|
Apache HTTPD server is configured to use an in-repository authz file,
|
|
with configuration directives such as:
|
|
|
|
AuthzSVNAccessFile "^/authz"
|
|
AuthzSVNReposRelativeAccessFile "^/authz"
|
|
|
|
The problem originates when sending a GET request to a non-existent
|
|
repository. The mod_authz_svn module will attempt to find authz rules
|
|
at a path within the requested SVN repository. Upon constructing this
|
|
path, the function svn_repos_find_root_path will return a NULL pointer
|
|
since the requested repository does not exist on-disk.
|
|
A check for this legitimate NULL pointer condition is missing, which
|
|
results in a segmentation fault when the NULL pointer is used.
|
|
|
|
The in-repository authz feature was first introduced in Subversion 1.8:
|
|
https://subversion.apache.org/docs/release-notes/1.8.html#in-repo-authz
|
|
|
|
The missing NULL check was first introduced during refactoring of the
|
|
authz code during development work leading up to Subversion 1.9.
|
|
Subversion 1.8 servers are unaffected.
|
|
|
|
Severity:
|
|
=========
|
|
|
|
CVSSv3 Base Score: 7.5 (High)
|
|
|
|
CVSSv3 Base Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
|
|
|
|
Exploitation results in denial of service by crashing the HTTPD worker
|
|
handling the request. The impact of this differs depending on how the
|
|
Apache HTTPD server is configured, including the choice of MPM (Multi-
|
|
Processing-Module). If the worker shares its memory address space with
|
|
the main thread, as is the case with e.g. the Event MPM, the entire
|
|
HTTPD server process will terminate. If the pre-fork MPM is used, the
|
|
worker will terminate but the HTTPD server will stay up, and service
|
|
availability will depend on how frequently the attacker is able to
|
|
send malicious requests which target the vulnerability.
|
|
|
|
Recommendations:
|
|
================
|
|
|
|
We recommend all users to upgrade to a known fixed release of the
|
|
Subversion mod_dav_svn server.
|
|
|
|
Users who are unable to upgrade may apply the included patches.
|
|
|
|
As a workaround, the use of in-repository authz rules files with
|
|
the AuthzSVNReposRelativeAccessFile can be avoided by switching
|
|
to an alternative configuration which fetches an authz rules file
|
|
from the server's filesystem, rather than from an SVN repository.
|
|
|
|
References:
|
|
===========
|
|
|
|
CVE-2020-17525 (Subversion)
|
|
|
|
Reported by:
|
|
============
|
|
|
|
Thomas Åkesson, simonsoft.se
|
|
|
|
Patches:
|
|
========
|
|
|
|
Patch for Subversion 1.10, 1.14:
|
|
|
|
[[[
|
|
Index: subversion/libsvn_repos/config_file.c
|
|
===================================================================
|
|
--- a/subversion/libsvn_repos/config_file.c (revision 1883994)
|
|
+++ b/subversion/libsvn_repos/config_file.c (working copy)
|
|
@@ -237,6 +237,10 @@ get_repos_config(svn_stream_t **stream,
|
|
{
|
|
/* Search for a repository in the full path. */
|
|
repos_root_dirent = svn_repos_find_root_path(dirent, scratch_pool);
|
|
+ if (repos_root_dirent == NULL)
|
|
+ return svn_error_trace(handle_missing_file(stream, checksum, access,
|
|
+ url, must_exist,
|
|
+ svn_node_none));
|
|
|
|
/* Attempt to open a repository at repos_root_dirent. */
|
|
SVN_ERR(svn_repos_open3(&access->repos, repos_root_dirent, NULL,
|
|
]]]
|