<?xml version="1.0" encoding="UTF-8"?>
<cvrfdoc xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:cpe="http://cpe.mitre.org/language/2.0" xmlns:cvrf="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf" xmlns:cvrf-common="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/common" xmlns:cvssv2="http://scap.nist.gov/schema/cvss-v2/1.0" xmlns:cvssv3="https://www.first.org/cvss/cvss-v3.0.xsd" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:ns0="http://purl.org/dc/elements/1.1/" xmlns:prod="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod" xmlns:scap-core="http://scap.nist.gov/schema/scap-core/1.0" xmlns:sch="http://purl.oclc.org/dsdl/schematron" xmlns:vuln="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/cvrf">
  <DocumentTitle xml:lang="en">Security update for subversion</DocumentTitle>
  <DocumentType>SUSE Patch</DocumentType>
  <DocumentPublisher Type="Vendor">
    <ContactDetails>security@suse.de</ContactDetails>
    <IssuingAuthority>SUSE Security Team</IssuingAuthority>
  </DocumentPublisher>
  <DocumentTracking>
    <Identification>
      <ID>SUSE-SU-2022:1483-1</ID>
    </Identification>
    <Status>Final</Status>
    <Version>1</Version>
    <RevisionHistory>
      <Revision>
        <Number>1</Number>
        <Date>2022-05-02T14:45:26Z</Date>
        <Description>current</Description>
      </Revision>
    </RevisionHistory>
    <InitialReleaseDate>2022-05-02T14:45:26Z</InitialReleaseDate>
    <CurrentReleaseDate>2022-05-02T14:45:26Z</CurrentReleaseDate>
    <Generator>
      <Engine>cve-database/bin/generate-cvrf.pl</Engine>
      <Date>2017-02-24T01:00:00Z</Date>
    </Generator>
  </DocumentTracking>
  <DocumentNotes>
    <Note Title="Topic" Type="Summary" Ordinal="1" xml:lang="en">Security update for subversion</Note>
    <Note Title="Details" Type="General" Ordinal="2" xml:lang="en">This update for subversion fixes the following issues:
    
- CVE-2022-24070: Fixed a memory corruption issue in mod_dav_svn as used by Apache HTTP server. This could be exploited by a remote attacker to cause a denial of service (bsc#1197940).
- CVE-2021-28544: Fixed an information leak issue where Subversion servers may reveal the original path of files protected by path-based authorization (bsc#1197939).


The following non-security bugs were fixed:

- Skip failing test on s390[x] (bsc#1198503).
</Note>
    <Note Title="Terms of Use" Type="Legal Disclaimer" Ordinal="3" xml:lang="en">The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).</Note>
    <Note Title="Patchnames" Type="Details" Ordinal="4" xml:lang="en">SUSE-2022-1483,SUSE-SLE-SDK-12-SP5-2022-1483</Note>
  </DocumentNotes>
  <DocumentDistribution xml:lang="en">Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0)</DocumentDistribution>
  <DocumentReferences>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221483-1/</URL>
      <Description>Link for SUSE-SU-2022:1483-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://lists.suse.com/pipermail/sle-security-updates/2022-May/010905.html</URL>
      <Description>E-Mail link for SUSE-SU-2022:1483-1</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/support/security/rating/</URL>
      <Description>SUSE Security Ratings</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1197939</URL>
      <Description>SUSE Bug 1197939</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1197940</URL>
      <Description>SUSE Bug 1197940</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://bugzilla.suse.com/1198503</URL>
      <Description>SUSE Bug 1198503</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2021-28544/</URL>
      <Description>SUSE CVE CVE-2021-28544 page</Description>
    </Reference>
    <Reference Type="Self">
      <URL>https://www.suse.com/security/cve/CVE-2022-24070/</URL>
      <Description>SUSE CVE CVE-2022-24070 page</Description>
    </Reference>
  </DocumentReferences>
  <ProductTree xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/prod">
    <Branch Type="Product Family" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <Branch Type="Product Name" Name="SUSE Linux Enterprise Software Development Kit 12 SP5">
        <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5" CPE="cpe:/o:suse:sle-sdk:12:sp5">SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
      </Branch>
    </Branch>
    <Branch Type="Product Version" Name="libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.1">
      <FullProductName ProductID="libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.1">libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-1.10.6-3.6.1">subversion-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-bash-completion-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-bash-completion-1.10.6-3.6.1">subversion-bash-completion-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-devel-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-devel-1.10.6-3.6.1">subversion-devel-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-perl-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-perl-1.10.6-3.6.1">subversion-perl-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-python-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-python-1.10.6-3.6.1">subversion-python-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-python-ctypes-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-python-ctypes-1.10.6-3.6.1">subversion-python-ctypes-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-ruby-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-ruby-1.10.6-3.6.1">subversion-ruby-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-server-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-server-1.10.6-3.6.1">subversion-server-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Branch Type="Product Version" Name="subversion-tools-1.10.6-3.6.1">
      <FullProductName ProductID="subversion-tools-1.10.6-3.6.1">subversion-tools-1.10.6-3.6.1</FullProductName>
    </Branch>
    <Relationship ProductReference="libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.1">libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="subversion-1.10.6-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-1.10.6-3.6.1">subversion-1.10.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="subversion-bash-completion-1.10.6-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-bash-completion-1.10.6-3.6.1">subversion-bash-completion-1.10.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="subversion-devel-1.10.6-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-devel-1.10.6-3.6.1">subversion-devel-1.10.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="subversion-perl-1.10.6-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-perl-1.10.6-3.6.1">subversion-perl-1.10.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="subversion-python-1.10.6-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-python-1.10.6-3.6.1">subversion-python-1.10.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="subversion-server-1.10.6-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-server-1.10.6-3.6.1">subversion-server-1.10.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
    <Relationship ProductReference="subversion-tools-1.10.6-3.6.1" RelationType="Default Component Of" RelatesToProductReference="SUSE Linux Enterprise Software Development Kit 12 SP5">
      <FullProductName ProductID="SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-tools-1.10.6-3.6.1">subversion-tools-1.10.6-3.6.1 as a component of SUSE Linux Enterprise Software Development Kit 12 SP5</FullProductName>
    </Relationship>
  </ProductTree>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="1">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.</Note>
    </Notes>
    <CVE>CVE-2021-28544</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-bash-completion-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-devel-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-perl-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-python-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-server-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-tools-1.10.6-3.6.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>moderate</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>3.5</BaseScoreV2>
        <VectorV2>AV:N/AC:M/Au:S/C:P/I:N/A:N</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>4.3</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221483-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2021-28544.html</URL>
        <Description>CVE-2021-28544</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1197939</URL>
        <Description>SUSE Bug 1197939</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
  <vuln:Vulnerability xmlns="http://docs.oasis-open.org/csaf/ns/csaf-cvrf/v1.2/vuln" Ordinal="2">
    <Notes>
      <Note Title="Vulnerability Description" Type="General" Ordinal="1" xml:lang="en">Subversion's mod_dav_svn is vulnerable to memory corruption. While looking up path-based authorization rules, mod_dav_svn servers may attempt to use memory which has already been freed. Affected Subversion mod_dav_svn servers 1.10.0 through 1.14.1 (inclusive). Servers that do not use mod_dav_svn are not affected.</Note>
    </Notes>
    <CVE>CVE-2022-24070</CVE>
    <ProductStatuses>
      <Status Type="Fixed">
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:libsvn_auth_gnome_keyring-1-0-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-bash-completion-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-devel-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-perl-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-python-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-server-1.10.6-3.6.1</ProductID>
        <ProductID>SUSE Linux Enterprise Software Development Kit 12 SP5:subversion-tools-1.10.6-3.6.1</ProductID>
      </Status>
    </ProductStatuses>
    <Threats>
      <Threat Type="Impact">
        <Description>important</Description>
      </Threat>
    </Threats>
    <CVSSScoreSets>
      <ScoreSetV2>
        <BaseScoreV2>5</BaseScoreV2>
        <VectorV2>AV:N/AC:L/Au:N/C:N/I:N/A:P</VectorV2>
      </ScoreSetV2>
      <ScoreSetV3>
        <BaseScoreV3>7.5</BaseScoreV3>
        <VectorV3>CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H</VectorV3>
      </ScoreSetV3>
    </CVSSScoreSets>
    <Remediations>
      <Remediation Type="Vendor Fix">
        <Description xml:lang="en">To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
</Description>
        <URL>https://www.suse.com/support/update/announcement/2022/suse-su-20221483-1/</URL>
      </Remediation>
    </Remediations>
    <References>
      <Reference>
        <URL>https://www.suse.com/security/cve/CVE-2022-24070.html</URL>
        <Description>CVE-2022-24070</Description>
      </Reference>
      <Reference>
        <URL>https://bugzilla.suse.com/1197940</URL>
        <Description>SUSE Bug 1197940</Description>
      </Reference>
    </References>
  </vuln:Vulnerability>
</cvrfdoc>
