Unscored severity · published Aug 19, 2014
CVE-2014-3522
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field…
–
CVSS
5.6%
EPSS
No
On KEV
Description
The Serf RA layer in Apache Subversion 1.4.0 through 1.7.x before 1.7.18 and 1.8.x before 1.8.10 does not properly handle wildcards in the Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof servers via a crafted certificate.
Exploitation
Is it being used?
Exploit prediction (EPSS)5.6% · higher than 93% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OP
Opensuse · Opensuse
12.3; 13.1 · source: NVD
SU
Subversion · Apache
1.4.0; 1.4.1; 1.4.2; 1.4.3; 1.4.4; 1.4.5; +34 more · source: NVD
UL
Ubuntu Linux · Canonical
12.04; 14.04 · source: NVD
XC
Xcode · Apple
6.1.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2014-3522
CVE.org
https://www.cve.org/CVERecord?id=CVE-2014-3522
Mailing List
http://lists.apple.com/archives/security-announce/2015/Mar/msg00003.html
Third Party Advisory
http://lists.opensuse.org/opensuse-updates/2014-08/msg00038.html
secunia.com
http://secunia.com/advisories/59432
secunia.com
http://secunia.com/advisories/59584
secunia.com
http://secunia.com/advisories/60100
secunia.com
http://secunia.com/advisories/60722
More from Subversion
9.8
CVE-2017-9800
A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command
8.8
CVE-2013-4246
libsvn_fs_fs/fs_fs.c in Apache Subversion 1.8.x before 1.8.2 might allow remote authenticated users with commit access to corrupt FSFS repositories and cause a denial of service…
8.6
CVE-2015-5259
Integer overflow in the read_string function in libsvn_ra_svn/marshal.c in Apache Subversion 1.9.x before 1.9.3 allows remote attackers to execute arbitrary code via an svn://…
7.8
CVE-2024-45720
On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line…
7.6
CVE-2015-5343
Integer overflow in util.c in mod_dav_svn in Apache Subversion 1.7.x, 1.8.x before 1.8.15, and 1.9.x before 1.9.3 allows remote authenticated users to cause a denial of service…