Apache Subversion 1.7.9 released

[Ben Reser <be...@reser.org>]

I'm happy to announce the release of Apache Subversion 1.7.9.
Please choose the mirror closest to you by visiting:

    http://subversion.apache.org/download/?update=201304041700#recommended-release

This release addesses five security issues:
    CVE-2013-1845: mod_dav_svn excessive memory usage from property changes
    CVE-2013-1846: mod_dav_svn crashes on LOCK requests against activity URLs
    CVE-2013-1847: mod_dav_svn crashes on LOCK requests against
non-existant URLs
    CVE-2013-1849: mod_dav_svn crashes on PROPFIND requests against
activity URLs
    CVE-2013-1884: mod_dav_svn crashes on out of range limit in log
REPORT request

More information on these vulnerabilities, including the relevent advisories
and potential attack vectors and workarounds, can be found on the Subversion
security website:
    http://subversion.apache.org/security/

The SHA1 checksums are:

    8be7bda6b6abb601885b3586dc2a9a5b29d034b0 subversion-1.7.9.zip
    1f0e23ea585accba98f0ca3bf9354343314caceb subversion-1.7.9.tar.gz
    453757bae78a800997559f2232483ab99238ec1e subversion-1.7.9.tar.bz2

PGP Signatures are available at:

    http://www.apache.org/dist/subversion/subversion-1.7.9.tar.bz2.asc
    http://www.apache.org/dist/subversion/subversion-1.7.9.tar.gz.asc
    http://www.apache.org/dist/subversion/subversion-1.7.9.zip.asc

For this release, the following people have provided PGP signatures:

   Ben Reser [4096R/16A0DE01] with fingerprint:
    19BB CAEF 7B19 B280 A0E2  175E 62D4 8FAD 16A0 DE01
   C. Michael Pilato [4096R/FE681333] with fingerprint:
    753B 2F9D F717 FA23 A43E  E7C3 F5E0 F001 FE68 1333
   Ivan Zhakov [4096R/F6AD8147] with fingerprint:
    4829 8F0F E47F 4B8A 43FD  6525 919F 6F61 F6AD 8147
   Mark Phippard [1024D/035A96A9] with fingerprint:
    D315 89DB E1C1 E9BA D218  39FD 265D F8A0 035A 96A9
   Paul T. Burba [4096R/56F3D7BC] with fingerprint:
    1A0F E7C6 B3C5 F8D4 D0C4  A20B 64DD C071 56F3 D7BC
   Philip Martin [2048R/ED1A599C] with fingerprint:
    A844 790F B574 3606 EE95  9207 76D7 88E1 ED1A 599C
   Stefan Sperling [2048R/9A59B973] with fingerprint:
    8BC4 DAE0 C5A4 D65F 4044  0107 4F7D BAA9 9A59 B973

Release notes for the 1.7.x release series may be found at:

    http://subversion.apache.org/docs/release-notes/1.7.html

You can find the list of changes between 1.7.9 and earlier versions at:

    http://svn.apache.org/repos/asf/subversion/tags/1.7.9/CHANGES

Questions, comments, and bug reports to users@subversion.apache.org.

Thanks,
- The Subversion Team

Re: Apache Subversion 1.7.9 released

[Mark Phippard <ma...@gmail.com>]

On Sun, Apr 7, 2013 at 6:36 AM, Nico Kadel-Garcia <nk...@gmail.com> wrote:
>
> My SRPM building tools have been updated to match, at:
>
>     https://github.com/nkadel/subversion-1.6.21-srpm
>
> and
>
>     https://github.com/nkadel/subversion-1.7.9-srpm
>
> Minor changes include the recent discard of support for RHEL 4 in the
> subverson-1.7.x build structure, and switching from using "autogen.sh" to
> simply "aclocal" and "autoconf" instead of building a custom backported
> Python locally on older systems, just to get the ./configure to work.

Nico,

Do these make their way to RepoForge?  I notice they are still on 1.7.4.

http://pkgs.repoforge.org/subversion/

I thought at one time you were maintaining those, but maybe I just got
confused.  Does anyone know who maintains RepoForge packages or how
that works?  They should get the packages updated to 1.7.9 if
possible.

--
Thanks

Mark Phippard
http://markphip.blogspot.com/

Re: Apache Subversion 1.7.9 released

[Nico Kadel-Garcia <nk...@gmail.com>]

My SRPM building tools have been updated to match, at:

    https://github.com/nkadel/subversion-1.6.21-srpm

and

    https://github.com/nkadel/subversion-1.7.9-srpm

Minor changes include the recent discard of support for RHEL 4 in the
subverson-1.7.x build structure, and switching from using "autogen.sh" to
simply "aclocal" and "autoconf" instead of building a custom backported
Python locally on older systems, just to get the ./configure to work.