Skip to content
Fencer Intel
high 7.5

CVE-2020-17525 in the critical feed json

Remote unauthenticated denial-of-service in Subversion mod_authz_svn

published 5y ago modified 4mo ago also BIT-subversion-2020-17525 , EUVD-2020-9463

cvss
7.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
40.1%
EPSS 40.1% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

Subversion's mod_authz_svn module will crash if the server is using in-repository authz rules with the AuthzSVNReposRelativeAccessFile option and a client sends a request for a non-existing repository URL. This can lead to disruption for users of the service. This issue was fixed in mod_dav_svn+mod_authz_svn servers 1.14.1 and mod_dav_svn+mod_authz_svn servers 1.10.7

Patch / fix

  • bitnami subversion 1.10.7, 1.14.1
  • Apache Software Foundation Apache Subversion 1.14.1, mod_authz_svn 1.10.7
  • subversion Debian 14, Debian 13, Debian 12 1.14.1-1

debian advisories DEBIAN-CVE-2020-17525

  • subversion Ubuntu 18.04 LTS 1.9.7-4ubuntu1.1
  • subversion Ubuntu 20.04 LTS 1.13.0-3ubuntu0.2
  • subversion Ubuntu Pro 16.04 LTS 1.9.3-2ubuntu1.3+esm1

ubuntu advisories UBUNTU-CVE-2020-17525

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • libserf RHEL 8 1.3.9-9.module+el8.3.0+6671+2675c974
  • utf8proc RHEL 8 2.1.1-5.module+el8.3.0+6671+2675c974
  • subversion RHEL 8 1.10.2-4.module+el8.3.0+9886+ac338b6d
  • mod_dav_svn RHEL 8 1.10.2-4.module+el8.3.0+9886+ac338b6d
  • subversion-libs RHEL 8 1.10.2-4.module+el8.3.0+9886+ac338b6d
  • subversion-perl RHEL 8 1.10.2-4.module+el8.3.0+9886+ac338b6d
  • subversion-gnome RHEL 8 1.10.2-4.module+el8.3.0+9886+ac338b6d
  • subversion-tools RHEL 8 1.10.2-4.module+el8.3.0+9886+ac338b6d

red hat advisories RHSA-2021:0509RHSA-2021:0508RHSA-2021:0507

  • subversion SLES for SAP 15 SP1, SLES for SAP 15, SLES 15-LTSS +13 more 1.10.6-3.15.1
  • subversion SLE Software Development Kit 12 SP5 1.10.6-3.3.1

suse advisories SUSE-SU-2021:0425-1SUSE-SU-2021:0424-1

  • subversion openSUSE Tumbleweed 1.14.1-1.11
  • subversion openSUSE Leap 15.2 1.10.6-lp152.2.9.1

opensuse advisories openSUSE-SU-2024:11412-1openSUSE-SU-2021:0280-1

  • libserf AlmaLinux 8 1.3.9-9.module_el8.3.0+2053+ac338b6d
  • libserf AlmaLinux 8 1.3.9-9.module_el8.6.0+2912+eb1cdf5a
  • libserf AlmaLinux 8 1.3.9-9.module_el8.4.0+2266+ac338b6d
  • utf8proc AlmaLinux 8 2.1.1-5.module_el8.4.0+2266+ac338b6d
  • utf8proc AlmaLinux 8 2.1.1-5.module_el8.3.0+2053+ac338b6d
  • utf8proc AlmaLinux 8 2.1.1-5.module_el8.6.0+2912+eb1cdf5a
  • subversion AlmaLinux 8 1.10.2-4.module_el8.4.0+2266+ac338b6d
  • subversion AlmaLinux 8 1.10.2-4.module_el8.5.0+73+aa7e29ed

almalinux advisories ALSA-2021:0507

  • libserf Rocky Linux 8 1.3.9-9.module+el8.7.0+1065+42200b2e
  • libserf Rocky Linux 8 1.3.9-9.module+el8.4.0+407+38733e5a
  • utf8proc Rocky Linux 8 2.1.1-5.module+el8.4.0+407+38733e5a
  • subversion Rocky Linux 8 1.10.2-4.module+el8.4.0+407+38733e5a

rocky linux advisories RLSA-2021:0507

  • subversion Alpine 3.10 1.12.2-r1
  • subversion Alpine 3.11 1.12.2-r2
  • subversion Alpine 3.12 1.13.0-r3
  • subversion Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.14.1-r0

alpine advisories ALPINE-CVE-2020-17525

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • subversion CBL-Mariner 2.0 1.14.0-4

azure linux advisories AZL-6899

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • subversion Arch Linux 1.14.1-1

arch linux advisories AVG-1563

Is CVE-2020-17525 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-17525 updated cvss 7.5

subversion: Remote unauthenticated denial of service in mod_authz_svn

  • Red Hat Enterprise Linux AppStream (v. 8) libserf 1.3.9-9.module+el8.3.0+6671+2675c974, utf8proc 2.1.1-5.module+el8.3.0+6671+2675c974, subversion 1.10.2-4.module+el8.3.0+9886+ac338b6d, mod_dav_svn 1.10.2-4.module+el8.3.0+9886+ac338b6d, subversion-libs 1.10.2-4.module+el8.3.0+9886+ac338b6d, subversion-perl 1.10.2-4.module+el8.3.0+9886+ac338b6d, +3 more
    fixed: vendor fix RHSA-2021:0507
  • Red Hat Enterprise Linux AppStream EUS (v. 8.1) libserf 1.3.9-9.module+el8.1.0+9889+0a9c19c4, utf8proc 2.1.1-5.module+el8.1.0+9889+0a9c19c4, subversion 1.10.2-2.module+el8.1.0+9889+0a9c19c4.1, mod_dav_svn 1.10.2-2.module+el8.1.0+9889+0a9c19c4.1, subversion-libs 1.10.2-2.module+el8.1.0+9889+0a9c19c4.1, subversion-perl 1.10.2-2.module+el8.1.0+9889+0a9c19c4.1, +3 more
    fixed: vendor fix RHSA-2021:0509
  • Red Hat Enterprise Linux AppStream EUS (v. 8.2) libserf 1.3.9-9.module+el8.2.0+9887+08558108, utf8proc 2.1.1-5.module+el8.2.0+9887+08558108, subversion 1.10.2-2.module+el8.2.0+9887+08558108.1, mod_dav_svn 1.10.2-2.module+el8.2.0+9887+08558108.1, subversion-libs 1.10.2-2.module+el8.2.0+9887+08558108.1, subversion-perl 1.10.2-2.module+el8.2.0+9887+08558108.1, +3 more
    fixed: vendor fix RHSA-2021:0508
  • Red Hat Enterprise Linux 6 subversion, mod_dav_svn, subversion-kde, subversion-perl, subversion-ruby, subversion-gnome, +2 more Red Hat Enterprise Linux 7 subversion, mod_dav_svn, subversion-kde, subversion-libs, subversion-perl, subversion-ruby, +4 more Red Hat Enterprise Linux 8 libserf, utf8proc, subversion, mod_dav_svn, subversion-libs, subversion-perl, +4 more Red Hat Enterprise Linux 9 subversion, mod_dav_svn, subversion-libs, subversion-perl, subversion-gnome, subversion-tools, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

40.08% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

  • subversion.apache.org https://subversion.apache.org/security/CVE-2020-17525-advisory.txt referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
bitnami subversion
>=1.9.0, <1.10.7
>=1.11.0, <1.14.1
1.10.7
1.14.1

Affected products

  • Apache Software Foundation Apache Subversion

Classification

Weakness

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.