Description
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | subversion | 1.8.10-1 | — |
| Debian 13 | subversion | 1.8.10-1 | — |
| Debian 12 | subversion | 1.8.10-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | subversion | 1.8.8-1ubuntu3.1 | USN-2316-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | subversion +10 | 1.7.14-7.el7_0 | RHSA-2015:0166 |
| RHEL 6 | subversion +8 | 1.6.11-12.el6_6 | RHSA-2015:0165 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | subversion | 1.9.5-1.1 | openSUSE-SU-2024:10538-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | subversion +10 | 1.7.14-7.el7_0 | ELSA-2015-0166 |
Advisories 5
- RHSA-2015:0166 Red Hat Security Advisory: subversion security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2015:0165 Red Hat Security Advisory: subversion security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- USN-2316-1 subversion vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- openSUSE-SU-2024:10538-1 libsvn_auth_gnome_keyring-1-0-1.9.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2015-0166 Moderate: subversion security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 10, 2015
References
- 59432 third-party-advisory
- USN-2316-1 vendor-advisory
- RHSA-2015:0166 vendor-advisory
- https://support.apple.com/HT204427
- 68995 vdb-entry
- http://subversion.apache.org/security/CVE-2014-3528-advisory.txt
- APPLE-SA-2015-03-09-4 vendor-advisory
- RHSA-2015:0165 vendor-advisory
- 60722 third-party-advisory
- openSUSE-SU-2014:1059 vendor-advisory
- GLSA-201610-05 vendor-advisory
- 59584 third-party-advisory
- http://www.oracle.com/technetwork/topics/security/bulletinoct2015-2511968.html