You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@subversion.apache.org by Daniel Sahlberg <ds...@apache.org> on 2024/12/09 00:10:28 UTC
[SECURITY][ANNOUNCE] Apache Subversion 1.14.5 released
I'm happy to announce the release of Apache Subversion 1.14.5.
This is a stable bugfix and security release of the Apache Subversion
open source version control system.
Among regular bug fixes, this release fixes CVE-2024-46901:
mod_dav_svn denial-of-service via control characters in paths
It has been discovered that the patch for CVE-2013-1968 was incomplete
and unintentionally left mod_dav_svn vulnerable to control characters
in filenames.
If a path or a revision-property which contains control characters is
committed to a repository then SVN operations served by mod_dav_svn
can be disrupted.
Reported by:
HaoZi, WordPress China
Full advisory:
https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
https://subversion.apache.org/security/CVE-2024-46901-advisory.txt.asc
Please choose the mirror closest to you by visiting:
https://subversion.apache.org/download.cgi#recommended-release
SHA-512 checksums are available at:
https://www.apache.org/dist/subversion/subversion-1.14.5.tar.bz2.sha512
https://www.apache.org/dist/subversion/subversion-1.14.5.tar.gz.sha512
https://www.apache.org/dist/subversion/subversion-1.14.5.zip.sha512
PGP Signatures are available at:
https://www.apache.org/dist/subversion/subversion-1.14.5.tar.bz2.asc
https://www.apache.org/dist/subversion/subversion-1.14.5.tar.gz.asc
https://www.apache.org/dist/subversion/subversion-1.14.5.zip.asc
For this release, the following people have provided PGP signatures:
Stefan Sperling [rsa2048/4F7DBAA99A59B973] with fingerprint:
8BC4 DAE0 C5A4 D65F 4044 0107 4F7D BAA9 9A59 B973
Nathan Hartman (CODE SIGNING KEY) [rsa4096/583F00ADF981C39F] with
fingerprint:
3F8E 467C B336 6E30 13E1 120D 583F 00AD F981 C39F
Daniel Sahlberg [ed25519/2B4822B4B6340BAC] with fingerprint:
7DC8 A7BF 3747 8FF4 8E33 E85E 2B48 22B4 B634 0BAC
Timofei Zhakov (CODE SIGNING KEY) [rsa4096/2A56BB6322864335] with
fingerprint:
B593 8A45 4FEA DBD4 3565 E85F 2A56 BB63 2286 4335
Johan Corveleyn [rsa4096/B59CE6D6010C8AAD] with fingerprint:
8AA2 C10E EAAD 44F9 6972 7AEA B59C E6D6 010C 8AAD
Evgeny Kotkov [rsa4096/B64FFF1209F9FA74] with fingerprint:
E7B2 A7F4 EC28 BE9F F8B3 8BA4 B64F FF12 09F9 FA74
These public keys are available at:
https://www.apache.org/dist/subversion/subversion-1.14.5.KEYS
Release notes for the 1.14.x release series may be found at:
https://subversion.apache.org/docs/release-notes/1.14.html
You can find the list of changes between 1.14.5 and earlier versions at:
https://svn.apache.org/repos/asf/subversion/tags/1.14.5/CHANGES
Questions, comments, and bug reports to users@subversion.apache.org.
Thanks,
- The Subversion Team
--
To unsubscribe, please see:
https://subversion.apache.org/mailing-lists.html#unsubscribing
RE: [EXTERNAL] Re: [SECURITY][ANNOUNCE] Apache Subversion 1.14.5 released
Posted by "Grierson, David (Principal Engineer) via users" <us...@subversion.apache.org>.
Thanks for the swift response Doug.
I have to admit that I didn't read the release notes in depth for 1.14.3 & 1.14.4 so hadn't spotted that there was no need for an update to the RPM for those releases. I was just a bit concerned that these RPMs had gone stale like the CollabNet releases previously.
I look forward to the 1.14.5 update.
Thanks again for your assistance with this.
Dg.
From: Doug Robinson <do...@cirata.com>
Sent: 10 December 2024 17:23
To: Grierson, David (Principal Engineer) <Da...@sky.uk>
Cc: users@subversion.apache.org
Subject: [EXTERNAL] Re: [SECURITY][ANNOUNCE] Apache Subversion 1.14.5 released
David:
On Tue, Dec 10, 2024 at 10:18 AM Grierson, David (Principal Engineer) via users <us...@subversion.apache.org>> wrote:
Does anyone know if the WANDisco RPMs are still being maintained?
https://opensource.wandisco.com/rhel/8Server/svn-1.14/RPMS/x86_64/
It looks like there hasn't been an update of these RPMs since 2022 and are missing 1.14.3 and 1.14.4.
The 1.14.3 release was considered defective due to Python binding issues so we did not publish it.
The 1.14.4 release was pushed out a few months back due to a severe Windows issue. We are building this release for Windows only but it is taking a bit longer than expected but should be out shortly. Windows only because we were informed about the impending release of 1.14.5 and so chose not to build the linux platforms.
We will start building the 1.14.5 release for all platforms as soon as we push out the Windows version of 1.14.4.
While the "wandisco.com<http://wandisco.com>" link will continue to work for the foreseeable future, please start using the new link:
cirata.com <https://eu01.z.antigena.com/l/kr8HZWDmvLLzIF_i4qczQXj4PlhMWuN1rFkpxAiv6OqYaUaIb61uYqJ1gkTiD3lBCSvk3dB9fsFCTDFt1oQUljRZEASC7GEiQdBXPvSFBdoNVOubPdrWYkWBOl8C537ovBxgKrdDnz~Mo9OG1wFBIqsgzIOIH~BrDrHil9SIsCoMzu6U-tH4-LM>
Please let me know if you have any questions?
Cheers.
Doug
--
Doug Robinson Senior Product Manager
P +1 925 396 1125
E doug.robinson@cirata.com
<ma...@cirata.com>
[https://cirata.com/storage/app/media/icons/cirata_logo_rgb-250px.png]
THIS MESSAGE AND ANY ATTACHMENTS ARE CONFIDENTIAL, PROPRIETARY AND MAY BE PRIVILEGED
If this message was misdirected, Cirata Ltd. and its subsidiaries, ("Cirata") does not waive any confidentiality or privilege. If you are not the intended recipient, please notify us immediately and destroy the message without disclosing its contents to anyone. Any distribution, use or copying of this email or the information it contains by other than an intended recipient is unauthorized. The views and opinions expressed in this email message are the author's own and may not reflect the views and opinions of Cirata, unless the author is authorized by Cirata to express such views or opinions on its behalf. All email sent to or from this address is subject to electronic storage and review by Cirata. Although Cirata operates anti-virus programs, it does not accept responsibility for any damage whatsoever caused by viruses being passed.
--------------------------------------------------------------------
This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk<ma...@sky.uk>. Thank you
--------------------------------------------------------------------
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.
Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD
Re: [SECURITY][ANNOUNCE] Apache Subversion 1.14.5 released
Posted by Doug Robinson <do...@cirata.com>.
David:
On Tue, Dec 10, 2024 at 10:18 AM Grierson, David (Principal Engineer) via
users <us...@subversion.apache.org> wrote:
> Does anyone know if the WANDisco RPMs are still being maintained?
>
> https://opensource.wandisco.com/rhel/8Server/svn-1.14/RPMS/x86_64/
>
> It looks like there hasn't been an update of these RPMs since 2022 and are
> missing 1.14.3 and 1.14.4.
>
The 1.14.3 release was considered defective due to Python binding issues so
we did not publish it.
The 1.14.4 release was pushed out a few months back due to a severe Windows
issue. We are building this release for Windows only but it is taking a
bit longer than expected but should be out shortly. Windows only because
we were informed about the impending release of 1.14.5 and so chose not to
build the linux platforms.
We will start building the 1.14.5 release for all platforms as soon as we
push out the Windows version of 1.14.4.
While the "wandisco.com" link will continue to work for the foreseeable
future, please start using the new link:
https://opensource.cirata.com/
Please let me know if you have any questions?
Cheers.
Doug
--
*Doug Robinson* Senior Product Manager
P +1 925 396 1125
*E* doug.robinson@cirata.com
--
THIS MESSAGE AND ANY ATTACHMENTS ARE CONFIDENTIAL, PROPRIETARY AND MAY
BE PRIVILEGED
If this message was misdirected, Cirata Ltd. and its
subsidiaries, ("Cirata") does not waive any confidentiality or privilege.
If you are not the intended recipient, please notify us immediately and
destroy the message without disclosing its contents to anyone. Any
distribution, use or copying of this email or the information it contains
by other than an intended recipient is unauthorized. The views and opinions
expressed in this email message are the author's own and may not reflect
the views and opinions of Cirata, unless the author is authorized by Cirata
to express such views or opinions on its behalf. All email sent to or from
this address is subject to electronic storage and review by Cirata.
Although Cirata operates anti-virus programs, it does not accept
responsibility for any damage whatsoever caused by viruses being passed.
RE: [SECURITY][ANNOUNCE] Apache Subversion 1.14.5 released
Posted by "Grierson, David (Principal Engineer) via users" <us...@subversion.apache.org>.
Hi,
Does anyone know if the WANDisco RPMs are still being maintained?
https://opensource.wandisco.com/rhel/8Server/svn-1.14/RPMS/x86_64/
It looks like there hasn't been an update of these RPMs since 2022 and are missing 1.14.3 and 1.14.4.
Thanks,
David.
--
David Grierson - Principal Engineer
Sky UK - Tech UK&I - Architecture & Platform Engineering - Developer Experience - Services
Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence.
Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD