CVE-2013-1845
published 2013-05-02CVE-2013-1845: The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of…
PriorityP413low2.1CVSS 2.0
AVNACHAuSCNINAP
EPSS
5.87%
92.4th percentile
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
Affected
39 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
| apache | subversion | — | — |
CVSS provenance
nvdv2.02.1LOWAV:N/AC:H/Au:S/C:N/I:N/A:P
osv2.1LOW
vendor_apache2.1LOW
vendor_debian2.1LOW
vendor_redhat2.1LOW
vendor_ubuntu2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Subversion vulnerabilities
vendor_ubuntu·2013-06-27·CVSS 2.1
CVE-2013-1845 [LOW] Subversion vulnerabilities
Title: Subversion vulnerabilities
Summary: Several security issues were fixed in Subversion.
Alexander Klink discovered that the Subversion mod_dav_svn module for
Apache did not properly handle a large number of properties. A remote
authenticated attacker could use this flaw to cause memory consumption,
leading to a denial of service. (CVE-2013-1845)
Ben Reser discovered that the Subversion mod_dav_svn module for
Apache did not properly handle certain LOCKs. A remote authenticated
attacker could use this flaw to cause Subversion to crash, leading to a
denial of service. (CVE-2013-1846)
Philip Martin and Ben Reser discovered that the Subversion mod_dav_svn
module for Apache did not properly handle certain LOCKs. A remote
attacker could use this flaw to cause Subversion to crash, leading
Red Hat
(mod_dav_svn): DoS (excessive memory use) when large number of properties are set or deleted
vendor_redhat·2013-04-04·CVSS 2.1
CVE-2013-1845 [LOW] (mod_dav_svn): DoS (excessive memory use) when large number of properties are set or deleted
(mod_dav_svn): DoS (excessive memory use) when large number of properties are set or deleted
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
Debian
CVE-2013-1845: subversion - The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and...
vendor_debian·2013·CVSS 2.1
CVE-2013-1845 [LOW] CVE-2013-1845: subversion - The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and...
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
Scope: local
bookworm: resolved (fixed in 1.7.9-1)
bullseye: resolved (fixed in 1.7.9-1)
forky: resolved (fixed in 1.7.9-1)
sid: resolved (fixed in 1.7.9-1)
trixie: resolved (fixed in 1.7.9-1)
Apache
Apache subversion: CVE-2013-1845
vendor_apache·CVSS 2.1
CVE-2013-1845 [LOW] Apache subversion: CVE-2013-1845
Apache subversion: CVE-2013-1845
-advisory.txt 1.0.0-1.6.20 and 1.7.0-1.7.8 mod_dav_svn excessive memory usage from property changes
GHSA
GHSA-mgxf-hfqq-6365: The mod_dav_svn Apache HTTPD server module in Subversion 1
ghsa_unreviewed·2022-05-14
CVE-2013-1845 [LOW] CWE-119 GHSA-mgxf-hfqq-6365: The mod_dav_svn Apache HTTPD server module in Subversion 1
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
OSV
CVE-2013-1845: The mod_dav_svn Apache HTTPD server module in Subversion 1
osv·2013-05-02·CVSS 2.1
CVE-2013-1845 [LOW] CVE-2013-1845: The mod_dav_svn Apache HTTPD server module in Subversion 1
The mod_dav_svn Apache HTTPD server module in Subversion 1.6.x before 1.6.21 and 1.7.0 through 1.7.8 allows remote authenticated users to cause a denial of service (memory consumption) by (1) setting or (2) deleting a large number of properties for a file or directory.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2013-1845 CVE-2013-1846 CVE-2013-1847 CVE-2013-1849 CVE-2013-1884 subversion various flaws [fedora-all]
bugzilla·2013-04-05·CVSS 2.1
CVE-2013-1845 [LOW] CVE-2013-1845 CVE-2013-1846 CVE-2013-1847 CVE-2013-1849 CVE-2013-1884 subversion various flaws [fedora-all]
CVE-2013-1845 CVE-2013-1846 CVE-2013-1847 CVE-2013-1849 CVE-2013-1884 subversion various flaws [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, please use the bodhi submission link
noted in the next comment(s). This will include the bug IDs of this
tracking bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available
Bugzilla
CVE-2013-1845 Subversion (mod_dav_svn): DoS (excessive memory use) when large number of properties are set or deleted
bugzilla·2013-03-29·CVSS 2.1
CVE-2013-1845 [LOW] CVE-2013-1845 Subversion (mod_dav_svn): DoS (excessive memory use) when large number of properties are set or deleted
CVE-2013-1845 Subversion (mod_dav_svn): DoS (excessive memory use) when large number of properties are set or deleted
It was found that Subversion's mod_dav_svn Apache HTTPD server module will use excessive amounts of memory when a large number of properties are set or deleted on a node. This can lead to a DoS.
Setting or deleting a large number of properties on a node (file or directory) will result in a large amount of memory use. Due to the memory pooling behavior of Apache httpd and Subversion the completion of the request will not result in the immediate release of memory used. Repeated commits with the same properties will result in each httpd process plateauing out at some amount of memory. This could result in a Denial of Service if the system is exhausted of all available memory
http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.htmlhttp://lists.opensuse.org/opensuse-updates/2013-06/msg00069.htmlhttp://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3Ehttp://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvSTMLbn4q_KM3Ph2UOeSiPGhEK4%3DSvwEjaHW_GUGkYWPQ%40mail.gmail.com%3Ehttp://rhn.redhat.com/errata/RHSA-2013-0737.htmlhttp://subversion.apache.org/security/CVE-2013-1845-advisory.txthttp://www.mandriva.com/security/advisories?name=MDVSA-2013:153http://www.ubuntu.com/usn/USN-1893-1https://bugzilla.redhat.com/show_bug.cgi?id=929082https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18973http://lists.opensuse.org/opensuse-updates/2013-04/msg00095.htmlhttp://lists.opensuse.org/opensuse-updates/2013-06/msg00069.htmlhttp://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvRoyVrZV12tgC0FMGrc6%2BMisd3qTcZ%2BDdpFGgTahkgAkQ%40mail.gmail.com%3Ehttp://mail-archives.apache.org/mod_mbox/subversion-announce/201304.mbox/%3CCADkdwvSTMLbn4q_KM3Ph2UOeSiPGhEK4%3DSvwEjaHW_GUGkYWPQ%40mail.gmail.com%3Ehttp://rhn.redhat.com/errata/RHSA-2013-0737.htmlhttp://subversion.apache.org/security/CVE-2013-1845-advisory.txthttp://www.mandriva.com/security/advisories?name=MDVSA-2013:153http://www.ubuntu.com/usn/USN-1893-1https://bugzilla.redhat.com/show_bug.cgi?id=929082https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A18973
2013-05-02
Published