]> code.ossystems Code Review - openembedded-core.git/commit
subversion: fix CVE-2015-3187
authorWenzong Fan <wenzong.fan@windriver.com>
Tue, 17 Nov 2015 05:38:42 +0000 (00:38 -0500)
committerRichard Purdie <richard.purdie@linuxfoundation.org>
Tue, 1 Dec 2015 21:30:56 +0000 (21:30 +0000)
commit6da25614edcad30fdb4bea8ff47b81ff81cdaed2
tree3243859f4b1f4bffb8887d8e9bc27e112f6f242a
parent29eb921ed074d86fa8d5b205a313eb3177473a63
subversion: fix CVE-2015-3187

The svn_repos_trace_node_locations function in Apache Subversion before
1.7.21 and 1.8.x before 1.8.14, when path-based authorization is used,
allows remote authenticated users to obtain sensitive path information
by reading the history of a node that has been moved from a hidden path.

Patch is from:
http://subversion.apache.org/security/CVE-2015-3187-advisory.txt

Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com>
Signed-off-by: Ross Burton <ross.burton@intel.com>
meta/recipes-devtools/subversion/subversion-1.8.13/subversion-CVE-2015-3187.patch [new file with mode: 0644]
meta/recipes-devtools/subversion/subversion_1.8.13.bb