[SECURITY]Apache Subversion 1.14.5 released

--000000000000b8646a0628cb316b
Content-Type: text/plain; charset="UTF-8"

I'm happy to announce the release of Apache Subversion 1.14.5.

This is a stable bugfix and security release of the Apache Subversion
open source version control system.

Among regular bug fixes, this release fixes CVE-2024-46901:

mod_dav_svn denial-of-service via control characters in paths

It has been discovered that the patch for CVE-2013-1968 was incomplete
and unintentionally left mod_dav_svn vulnerable to control characters
in filenames.

If a path or a revision-property which contains control characters is
committed to a repository then SVN operations served by mod_dav_svn
can be disrupted.

Reported by:
HaoZi, WordPress China

Full advisory:
https://subversion.apache.org/security/CVE-2024-46901-advisory.txt
https://subversion.apache.org/security/CVE-2024-46901-advisory.txt.asc

Please choose the mirror closest to you by visiting:

    https://subversion.apache.org/download.cgi#recommended-release

SHA-512 checksums are available at:

    https://www.apache.org/dist/subversion/subversion-1.14.5.tar.bz2.sha512
    https://www.apache.org/dist/subversion/subversion-1.14.5.tar.gz.sha512
    https://www.apache.org/dist/subversion/subversion-1.14.5.zip.sha512

PGP Signatures are available at:

    https://www.apache.org/dist/subversion/subversion-1.14.5.tar.bz2.asc
    https://www.apache.org/dist/subversion/subversion-1.14.5.tar.gz.asc
    https://www.apache.org/dist/subversion/subversion-1.14.5.zip.asc

For this release, the following people have provided PGP signatures:

   Stefan Sperling [rsa2048/4F7DBAA99A59B973] with fingerprint:
    8BC4 DAE0 C5A4 D65F 4044  0107 4F7D BAA9 9A59 B973
   Nathan Hartman (CODE SIGNING KEY) [rsa4096/583F00ADF981C39F] with
fingerprint:
    3F8E 467C B336 6E30 13E1  120D 583F 00AD F981 C39F
   Daniel Sahlberg [ed25519/2B4822B4B6340BAC] with fingerprint:
    7DC8 A7BF 3747 8FF4 8E33  E85E 2B48 22B4 B634 0BAC
   Timofei Zhakov (CODE SIGNING KEY) [rsa4096/2A56BB6322864335] with
fingerprint:
    B593 8A45 4FEA DBD4 3565  E85F 2A56 BB63 2286 4335
   Johan Corveleyn [rsa4096/B59CE6D6010C8AAD] with fingerprint:
    8AA2 C10E EAAD 44F9 6972  7AEA B59C E6D6 010C 8AAD
   Evgeny Kotkov [rsa4096/B64FFF1209F9FA74] with fingerprint:
    E7B2 A7F4 EC28 BE9F F8B3  8BA4 B64F FF12 09F9 FA74

These public keys are available at:

    https://www.apache.org/dist/subversion/subversion-1.14.5.KEYS

Release notes for the 1.14.x release series may be found at:

    https://subversion.apache.org/docs/release-notes/1.14.html

You can find the list of changes between 1.14.5 and earlier versions at:

    https://svn.apache.org/repos/asf/subversion/tags/1.14.5/CHANGES

Questions, comments, and bug reports to [email protected].

Thanks,
- The Subversion Team

--
To unsubscribe, please see:

    https://subversion.apache.org/mailing-lists.html#unsubscribing

--000000000000b8646a0628cb316b
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr"><div di=
r=3D"ltr"><div dir=3D"ltr"><div dir=3D"ltr">I&#39;m happy to announce the r=
elease of Apache Subversion 1.14.5.<br><br>This is a stable bugfix and secu=
rity release of the Apache Subversion<br>open source version control system=
.<br><br>Among regular bug fixes, this release fixes CVE-2024-46901:</div><=
div dir=3D"ltr"><br></div><div dir=3D"ltr">mod_dav_svn denial-of-service vi=
a control characters in paths</div><div dir=3D"ltr"><br></div><div dir=3D"l=
tr"><div dir=3D"ltr">It has been discovered that the patch for CVE-2013-196=
8 was incomplete</div><div dir=3D"ltr">and unintentionally left mod_dav_svn=
 vulnerable to control characters</div><div dir=3D"ltr">in filenames.</div>=
<div dir=3D"ltr"><br></div><div dir=3D"ltr">If a path or a revision-propert=
y which contains control characters is</div><div dir=3D"ltr">committed to a=
 repository then SVN operations served by mod_dav_svn</div><div dir=3D"ltr"=
>can be disrupted.</div><div dir=3D"ltr"><br></div><div dir=3D"ltr">Reporte=
d by:</div><div dir=3D"ltr">HaoZi, WordPress China</div></div><div dir=3D"l=
tr"><br></div><div dir=3D"ltr">Full advisory:</div><div dir=3D"ltr"><a href=
=3D"https://subversion.apache.org/security/CVE-2024-46901-advisory.txt">htt=
ps://subversion.apache.org/security/CVE-2024-46901-advisory.txt</a> <a href=
=3D"https://subversion.apache.org/security/CVE-2024-46901-advisory.txt.asc"=
>https://subversion.apache.org/security/CVE-2024-46901-advisory.txt.asc</a>=
</div><div dir=3D"ltr"><br>Please choose the mirror closest to you by visit=
ing:<br><br>=C2=A0 =C2=A0 <a href=3D"https://subversion.apache.org/download=
.cgi#recommended-release">https://subversion.apache.org/download.cgi#recomm=
ended-release</a><br><br>SHA-512 checksums are available at:<br><br>=C2=A0 =
=C2=A0 <a href=3D"https://www.apache.org/dist/subversion/subversion-1.14.5.=
tar.bz2.sha512">https://www.apache.org/dist/subversion/subversion-1.14.5.ta=
r.bz2.sha512</a><br>=C2=A0 =C2=A0 <a href=3D"https://www.apache.org/dist/su=
bversion/subversion-1.14.5.tar.gz.sha512">https://www.apache.org/dist/subve=
rsion/subversion-1.14.5.tar.gz.sha512</a><br>=C2=A0 =C2=A0 <a href=3D"https=
://www.apache.org/dist/subversion/subversion-1.14.5.zip.sha512">https://www=
.apache.org/dist/subversion/subversion-1.14.5.zip.sha512</a><br><br>PGP Sig=
natures are available at:<br><br>=C2=A0 =C2=A0 <a href=3D"https://www.apach=
e.org/dist/subversion/subversion-1.14.5.tar.bz2.asc">https://www.apache.org=
/dist/subversion/subversion-1.14.5.tar.bz2.asc</a><br>=C2=A0 =C2=A0 <a href=
=3D"https://www.apache.org/dist/subversion/subversion-1.14.5.tar.gz.asc">ht=
tps://www.apache.org/dist/subversion/subversion-1.14.5.tar.gz.asc</a><br>=
=C2=A0 =C2=A0 <a href=3D"https://www.apache.org/dist/subversion/subversion-=
1.14.5.zip.asc">https://www.apache.org/dist/subversion/subversion-1.14.5.zi=
p.asc</a><br><br>For this release, the following people have provided PGP s=
ignatures:<br><br>=C2=A0 =C2=A0Stefan Sperling [rsa2048/4F7DBAA99A59B973] w=
ith fingerprint:<br>=C2=A0 =C2=A0 8BC4 DAE0 C5A4 D65F 4044 =C2=A00107 4F7D =
BAA9 9A59 B973<br>=C2=A0 =C2=A0Nathan Hartman (CODE SIGNING KEY) [rsa4096/5=
83F00ADF981C39F] with fingerprint:<br>=C2=A0 =C2=A0 3F8E 467C B336 6E30 13E=
1 =C2=A0120D 583F 00AD F981 C39F<br>=C2=A0 =C2=A0Daniel Sahlberg [ed25519/2=
B4822B4B6340BAC] with fingerprint:<br>=C2=A0 =C2=A0 7DC8 A7BF 3747 8FF4 8E3=
3 =C2=A0E85E 2B48 22B4 B634 0BAC<br>=C2=A0 =C2=A0Timofei Zhakov (CODE SIGNI=
NG KEY) [rsa4096/2A56BB6322864335] with fingerprint:<br>=C2=A0 =C2=A0 B593 =
8A45 4FEA DBD4 3565 =C2=A0E85F 2A56 BB63 2286 4335<br>=C2=A0 =C2=A0Johan Co=
rveleyn [rsa4096/B59CE6D6010C8AAD] with fingerprint:<br>=C2=A0 =C2=A0 8AA2 =
C10E EAAD 44F9 6972 =C2=A07AEA B59C E6D6 010C 8AAD<br>=C2=A0 =C2=A0Evgeny K=
otkov [rsa4096/B64FFF1209F9FA74] with fingerprint:<br>=C2=A0 =C2=A0 E7B2 A7=
F4 EC28 BE9F F8B3 =C2=A08BA4 B64F FF12 09F9 FA74<br><br>These public keys a=
re available at:<br><br>=C2=A0 =C2=A0 <a href=3D"https://www.apache.org/dis=
t/subversion/subversion-1.14.5.KEYS">https://www.apache.org/dist/subversion=
/subversion-1.14.5.KEYS</a><br><br>Release notes for the 1.14.x release ser=
ies may be found at:<br><br>=C2=A0 =C2=A0 <a href=3D"https://subversion.apa=
che.org/docs/release-notes/1.14.html">https://subversion.apache.org/docs/re=
lease-notes/1.14.html</a><br><br>You can find the list of changes between 1=
.14.5 and earlier versions at:<br><br>=C2=A0 =C2=A0 <a href=3D"https://svn.=
apache.org/repos/asf/subversion/tags/1.14.5/CHANGES">https://svn.apache.org=
/repos/asf/subversion/tags/1.14.5/CHANGES</a><br><br>Questions, comments, a=
nd bug reports to <a href=3D"mailto:[email protected]">users@subv=
ersion.apache.org</a>.<br><br>Thanks,<br>- The Subversion Team<br><br>--<br=
>To unsubscribe, please see:<br><br>=C2=A0 =C2=A0 <a href=3D"https://subver=
sion.apache.org/mailing-lists.html#unsubscribing">https://subversion.apache=
.org/mailing-lists.html#unsubscribing</a></div></div></div></div></div></di=
v></div>

--000000000000b8646a0628cb316b--