Improper input validation in Apache Subversion
CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain (untunneled) svn://.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.189 (97.3th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.178 · newest: 0.189 · change: +0.011
Affected products
- Apache Subversion — versions 1.9.0, 1.9.1, 1.9.2
- Apache Software Foundation Subversion — versions 1.9.0 to 1.9.6, 1.0.0 to 1.8.18
Weakness classification (CWE)
Public proof-of-concept exploits
References
- lists.apache.org/thread.html/cb607dc2f13bab9769147759ddccb14a4f9d8e5cdcad5e99c0… (mailing-list)
- www.securityfocus.com/bid/100259 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securityfocus.com/archive/1/540999/100/0/threaded (mailing-list)
- access.redhat.com/errata/RHSA-2017:2480 (vendor-advisory)
- www.securitytracker.com/id/1039127 (VDB Entry, Third Party Advisory, vdb-entry)
- security.gentoo.org/glsa/201709-09 (vendor-advisory)
- www.debian.org/security/2017/dsa-3932 (vendor-advisory)
- lists.apache.org/thread.html/d8cf53affd700dfce90bad4968fb8b1dfb69cf7c443052c703… (mailing-list)
- www.oracle.com/security-alerts/cpuoct2020.html
- confluence.atlassian.com/sourcetreekb/sourcetree-security-advisory-2017-08-11-9…
Frequently asked questions
- What is CVE-2017-9800?
- CVE-2017-9800 is a critical-severity vulnerability in Apache Subversion, classified under Improper Input Validation. CVSS score: 9.8/10. Published 2017-08-11.
- How severe is CVE-2017-9800?
- Critical severity. CVSS v3 base score is 9.8 out of 10.
- Is CVE-2017-9800 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.