CVE-2024-46901
Fixed in a distro release EPSS 2%CVSS 3.1
Insufficient validation of filenames against control characters in Apache Subversion repositories served via mod_dav_svn allows authenticated users with commit access to commit a corrupted revision, leading to disruption for users of the repository. All versions of Subversion up to and including Subversion 1.14.4 are affected if serving repositories via mod_dav_svn. Users are recommended to upgrade to version 1.14.5, which fixes this issue. Repositories served via other access methods are not affected.
Products: Apache Software Foundation Apache Subversion
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine:v3.18 | subversion | 1.14.5-r0 |
| Alpine:v3.19 | subversion | 1.14.5-r0 |
| Alpine:v3.20 | subversion | 1.14.5-r0 |
| Alpine:v3.21 | subversion | 1.14.5-r0 |
| Alpine:v3.22 | subversion | 1.14.5-r0 |
| Alpine:v3.23 | subversion | 1.14.5-r0 |
| Alpine:v3.24 | subversion | 1.14.5-r0 |
| Debian:11 | subversion | 1.14.1-3+deb11u2 |
| Debian:12 | subversion | 1.14.2-4+deb12u1 |
| Debian:13 | subversion | 1.14.5-1 |
| Debian:14 | subversion | 1.14.5-1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP5 | subversion | 1.14.1-150400.5.3.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | subversion | 1.14.1-150400.5.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP5 | subversion | 1.14.1-150400.5.3.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | subversion | 1.14.1-150400.5.3.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP5 | subversion | 1.14.1-150400.5.3.1 |
| SUSE:Linux Enterprise Module for Server Applications 15 SP6 | subversion | 1.14.1-150400.5.3.1 |
| SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | subversion | 1.10.6-3.9.1 |
| Ubuntu:Pro:16.04:LTS | subversion | 1.9.3-2ubuntu1.3+esm2 |
| Ubuntu:Pro:18.04:LTS | subversion | 1.9.7-4ubuntu1.1+esm1 |
| Ubuntu:Pro:20.04:LTS | subversion | 1.13.0-3ubuntu0.2+esm2 |
| Ubuntu:Pro:22.04:LTS | subversion | 1.14.1-3ubuntu0.22.04.1+esm1 |
| Ubuntu:Pro:24.04:LTS | subversion | 1.14.3-1ubuntu0.1~esm1 |
| openSUSE:Leap 15.5 | subversion | 1.14.1-150400.5.3.1 |
| openSUSE:Leap 15.6 | subversion | 1.14.1-150400.5.3.1 |
| openSUSE:Tumbleweed | subversion | 1.14.5-1.1 |