Description
authz.c in the mod_dav_svn module for the Apache HTTP Server, as distributed in Apache Subversion 1.5.x before 1.5.8 and 1.6.x before 1.6.13, when SVNPathAuthz short_circuit is enabled, does not properly handle a named repository as a rule scope, which allows remote authenticated users to bypass intended access restrictions via svn commands.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | subversion | 1.6.12dfsg-2 | — |
| Debian 13 | subversion | 1.6.12dfsg-2 | — |
| Debian 12 | subversion | 1.6.12dfsg-2 | — |
| Debian 5.0 | subversion | 1.5.1dfsg1-5 | DSA-2118-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | subversion +8 | 1.6.11-2.el6_0.2 | RHSA-2011:0258 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | subversion | 1.9.5-1.1 | openSUSE-SU-2024:10538-1 |
Advisories 3
- RHSA-2011:0258 Red Hat Security Advisory: subversion security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2118-1 subversion - authentication bypass Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10538-1 libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- oval:org.mitre.oval:def:19007 vdb-entry signature
- 41652 third-party-advisory
- http://subversion.apache.org/security/CVE-2010-3315-advisory.txt
- http://security-tracker.debian.org/tracker/CVE-2010-3315
- ADV-2011-0264 vdb-entry
- APPLE-SA-2011-03-21-1 vendor-advisory
- DSA-2118 vendor-advisory
- 43346 third-party-advisory
- RHSA-2011:0258 vendor-advisory
- USN-1053-1 vendor-advisory
- SUSE-SR:2010:024 vendor-advisory
- MDVSA-2010:199 vendor-advisory
- 43139 third-party-advisory
- http://support.apple.com/kb/HT4581