CVE-2017-9800
Fixed in a distro release EPSS 19%
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Products: Apache Software Foundation Apache Subversion
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | subversion | 1.9.7-r0 |
| Alpine 3.11 | subversion | 1.9.7-r0 |
| Alpine 3.12 | subversion | 1.9.7-r0 |
| Alpine 3.13 | subversion | 1.9.7-r0 |
| Alpine 3.14 | subversion | 1.9.7-r0 |
| Alpine 3.15 | subversion | 1.9.7-r0 |
| Alpine 3.16 | subversion | 1.9.7-r0 |
| Alpine 3.17 | subversion | 1.9.7-r0 |
| Alpine 3.18 | subversion | 1.9.7-r0 |
| Alpine 3.19 | subversion | 1.9.7-r0 |
| Alpine 3.20 | subversion | 1.9.7-r0 |
| Alpine 3.21 | subversion | 1.9.7-r0 |
| Alpine 3.22 | subversion | 1.9.7-r0 |
| Alpine 3.23 | subversion | 1.9.7-r0 |
| Alpine 3.24 | subversion | 1.9.7-r0 |
| Alpine 3.3 | subversion | 1.9.7-r0 |
| Alpine 3.4 | subversion | 1.9.7-r0 |
| Alpine 3.5 | subversion | 1.9.7-r0 |
| Alpine 3.6 | subversion | 1.9.7-r0 |
| Alpine 3.7 | subversion | 1.9.7-r0 |
| Alpine 3.8 | subversion | 1.9.7-r0 |
| Alpine 3.9 | subversion | 1.9.7-r0 |
| Arch Linux | subversion | 1.9.7-1 |
| Debian 12 | subversion | 1.9.7-1 |
| Debian 13 | subversion | 1.9.7-1 |
| Debian 14 | subversion | 1.9.7-1 |
| Debian 7 | subversion | 1.6.17dfsg-4+deb7u12 |
| Debian 8 | subversion | 1.8.10-6+deb8u5 |
| Debian 9 | subversion | 1.9.5-1+deb9u1 |
| Red Hat Enterprise Linux 7 | mod_dav_svn | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-debuginfo | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-devel | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-gnome | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-javahl | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-kde | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-libs | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-perl | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-python | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-ruby | 0:1.7.14-11.el7_4 |
| Red Hat Enterprise Linux 7 | subversion-tools | 0:1.7.14-11.el7_4 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | subversion | 1.6.17-1.36.9.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP2 | subversion | 1.8.19-25.3.1 |
| SUSE Linux Enterprise Software Development Kit 12 SP3 | subversion | 1.8.19-25.3.1 |
| SUSE Studio Onsite 1.3 | subversion | 1.6.17-1.36.9.1 |
| Ubuntu 14.04 LTS | subversion | 1.8.8-1ubuntu3.3 |
| Ubuntu 16.04 LTS | subversion | 1.9.3-2ubuntu1.1 |
| openSUSE Tumbleweed | subversion | 1.14.1-1.11 |