ALAS2022-2022-149

Amazon Linux 2022 Security Advisory: ALAS-2022-149
Advisory Release Date: 2022-10-03 21:26 Pacific
Advisory Updated Date: 2022-10-13 18:48 Pacific
Severity: Important
Issue Overview:

A flaw was found in Subversion. When using path-based authorization (authz), the helper function detect_changed() does not omit potentially sensitive information from log messages. In particular, if a node is copied from a protected location, its copyfrom path (the path to the protected location) is reported even when omission should occur. (CVE-2021-28544)

A use-after-free vulnerability was found in Subversion in the mod_dav_svn Apache HTTP server (HTTPd) module. While looking up path-based authorization (authz) rules, multiple calls to the post_config hook can invalidate cached pointers to object-pools, which Subversion subsequently uses. This issue crashes the single HTTPd worker thread or the entire HTTPd server process, depending on the configuration of the Apache HTTPd server. (CVE-2022-24070)


Affected Packages:

subversion


Issue Correction:
Run dnf update subversion --releasever=2022.0.20221012 to update your system.

New Packages:
aarch64:
    subversion-1.14.2-5.amzn2022.0.1.aarch64
    python3-subversion-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
    subversion-tools-1.14.2-5.amzn2022.0.1.aarch64
    subversion-tools-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
    subversion-devel-1.14.2-5.amzn2022.0.1.aarch64
    subversion-devel-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
    subversion-perl-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
    python3-subversion-1.14.2-5.amzn2022.0.1.aarch64
    subversion-debugsource-1.14.2-5.amzn2022.0.1.aarch64
    subversion-perl-1.14.2-5.amzn2022.0.1.aarch64
    subversion-libs-1.14.2-5.amzn2022.0.1.aarch64
    subversion-libs-debuginfo-1.14.2-5.amzn2022.0.1.aarch64
    subversion-debuginfo-1.14.2-5.amzn2022.0.1.aarch64

noarch:
    subversion-javahl-1.14.2-5.amzn2022.0.1.noarch

src:
    subversion-1.14.2-5.amzn2022.0.1.src

x86_64:
    subversion-devel-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
    subversion-1.14.2-5.amzn2022.0.1.x86_64
    subversion-perl-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
    subversion-tools-1.14.2-5.amzn2022.0.1.x86_64
    python3-subversion-1.14.2-5.amzn2022.0.1.x86_64
    subversion-tools-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
    python3-subversion-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
    subversion-libs-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
    subversion-debuginfo-1.14.2-5.amzn2022.0.1.x86_64
    subversion-devel-1.14.2-5.amzn2022.0.1.x86_64
    subversion-libs-1.14.2-5.amzn2022.0.1.x86_64
    subversion-debugsource-1.14.2-5.amzn2022.0.1.x86_64
    subversion-perl-1.14.2-5.amzn2022.0.1.x86_64

Additional References

Red Hat: CVE-2021-28544, CVE-2022-24070

Mitre: CVE-2021-28544, CVE-2022-24070