Home

CVE-2017-9800

Description

A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that servers repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.

Risk Information

Base Score
9.8
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score
Exploitation Probability
57.377

Associated Vulnerability

VulnerabilityOS Platform
Advanced version control system (USN-3388-1) libsvn1_1.8.8-1ubuntu3.3_i386.debLinux
Advanced version control system (USN-3388-1) libsvn1_1.8.8-1ubuntu3.3_amd64.debLinux
Advanced version control system (USN-3388-1) libsvn1_1.9.3-2ubuntu1.1_i386.debLinux
Advanced version control system (USN-3388-1) libsvn1_1.9.3-2ubuntu1.1_amd64.debLinux
Advanced version control system (USN-3388-1) libsvn1_1.9.5-1ubuntu1.1_i386.debLinux
Advanced version control system (USN-3388-1) libsvn1_1.9.5-1ubuntu1.1_amd64.debLinux
Advanced version control system (USN-3388-1) subversion_1.8.8-1ubuntu3.3_i386.debLinux
Advanced version control system (USN-3388-1) subversion_1.8.8-1ubuntu3.3_amd64.debLinux
Advanced version control system (USN-3388-1) subversion_1.9.3-2ubuntu1.1_i386.debLinux
Advanced version control system (USN-3388-1) subversion_1.9.3-2ubuntu1.1_amd64.debLinux
Advanced version control system (USN-3388-1) subversion_1.9.5-1ubuntu1.1_i386.debLinux
Advanced version control system (USN-3388-1) subversion_1.9.5-1ubuntu1.1_amd64.debLinux
Advanced version control system (USN-3388-1) libapache2-svn_1.8.8-1ubuntu3.3_all.debLinux
Advanced version control system (USN-3388-1) libapache2-svn_1.9.3-2ubuntu1.1_all.debLinux
Advanced version control system (USN-3388-1) libapache2-mod-svn_1.8.8-1ubuntu3.3_i386.debLinux
Advanced version control system (USN-3388-1) libapache2-mod-svn_1.8.8-1ubuntu3.3_amd64.debLinux
Advanced version control system (USN-3388-1) libapache2-mod-svn_1.9.3-2ubuntu1.1_i386.debLinux
Advanced version control system (USN-3388-1) libapache2-mod-svn_1.9.3-2ubuntu1.1_amd64.debLinux
(RHSA-2017:2480) Important: subversion security update mod_dav_svn-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-1.7.14-11.el7_4.i686.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-devel-1.7.14-11.el7_4.i686.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-devel-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-gnome-1.7.14-11.el7_4.i686.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-gnome-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-javahl-1.7.14-11.el7_4.i686.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-javahl-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-kde-1.7.14-11.el7_4.i686.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-kde-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-libs-1.7.14-11.el7_4.i686.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-libs-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-perl-1.7.14-11.el7_4.i686.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-perl-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-python-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-ruby-1.7.14-11.el7_4.i686.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-ruby-1.7.14-11.el7_4.x86_64.rpmLinux
(RHSA-2017:2480) Important: subversion security update subversion-tools-1.7.14-11.el7_4.x86_64.rpmLinux
Subversion-gnome update (ELSA-2017-2480) subversion-gnome-1.7.14-11.el7_4.x86_64.rpmLinux
Subversion update (ELSA-2017-2480) subversion-1.7.14-11.el7_4.i686.rpmLinux
Subversion-gnome update (ELSA-2017-2480) subversion-gnome-1.7.14-11.el7_4.i686.rpmLinux

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234