Description
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | subversion | 1.8.10-1 | — |
| Debian 13 | subversion | 1.8.10-1 | — |
| Debian 12 | subversion | 1.8.10-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | subversion | 1.8.8-1ubuntu3.1 | USN-2316-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | subversion | 1.9.5-1.1 | openSUSE-SU-2024:10538-1 |
Advisories 2
- USN-2316-1 subversion vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10538-1 libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 59432 third-party-advisory
- USN-2316-1 vendor-advisory
- https://support.apple.com/HT204427
- 109996 vdb-entry
- APPLE-SA-2015-03-09-4 vendor-advisory
- apache-subversion-cve20143522-spoofing(95311) vdb-entry
- https://subversion.apache.org/security/CVE-2014-3522-advisory.txt
- 60100 third-party-advisory
- 60722 third-party-advisory
- 69237 vdb-entry
- openSUSE-SU-2014:1059 vendor-advisory
- GLSA-201610-05 vendor-advisory
- 59584 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html
- apache-subversion-cve20143528-info-disc(95090) vdb-entry