CVE catalog

CVE-2021-28544

subversion: CVE-2021-28544

[CVE catalog]

Severity
Medium · CVSS 4.3CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.79% · Oct 25, 2026

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiansubversionsid1.14.5-6fixed
Debiansubversionforky1.14.5-6fixed
Debiansubversiontrixie1.14.5-3fixed
Debiansubversionbookworm1.14.2-4+deb12u1fixed
Alpinesubversion3.131.14.2-r0fixed
Alpinesubversion3.141.14.2-r0fixed
Alpinesubversion3.151.14.2-r0fixed
Alpinesubversion3.161.14.2-r0fixed
Alpinesubversion3.171.14.2-r0fixed
Alpinesubversion3.181.14.2-r0fixed
Alpinesubversion3.191.14.2-r0fixed
Alpinesubversion3.201.14.2-r0fixed
Alpinesubversion3.211.14.2-r0fixed
Alpinesubversion3.221.14.2-r0fixed
Alpinesubversion3.231.14.2-r0fixed
Alpinesubversion3.241.14.2-r0fixed
Ubuntusubversion20.041.10.6-1vulnerable
Ubuntusubversion20.041.10.6-1build1vulnerable
Ubuntusubversion20.041.13.0-1vulnerable
Ubuntusubversion20.041.13.0-1ubuntu1vulnerable
Ubuntusubversion20.041.13.0-2vulnerable
Ubuntusubversion20.041.13.0-2ubuntu2vulnerable
Ubuntusubversion20.041.13.0-3vulnerable
Ubuntusubversion20.041.13.0-3ubuntu0.1fixed
Ubuntusubversion22.041.14.1-3vulnerable
Ubuntusubversion22.041.14.1-3build2vulnerable
Ubuntusubversion22.041.14.1-3build3vulnerable
Ubuntusubversion22.041.14.1-3build4vulnerable
Ubuntusubversion22.041.14.1-3ubuntu0.22.04.1fixed
Ubuntusubversion22.041.14.1-3vulnerable
Ubuntusubversion22.041.14.1-3build2vulnerable
Ubuntusubversion22.041.14.1-3build3vulnerable
Ubuntusubversion22.041.14.1-3build4vulnerable
Ubuntusubversion22.041.14.1-3ubuntu0.22.04.1fixed
Ubuntusubversion20.041.10.6-1vulnerable
Ubuntusubversion20.041.10.6-1build1vulnerable
Ubuntusubversion20.041.13.0-1vulnerable
Ubuntusubversion20.041.13.0-1ubuntu1vulnerable
Ubuntusubversion20.041.13.0-2vulnerable
Ubuntusubversion20.041.13.0-2ubuntu2vulnerable
Ubuntusubversion20.041.13.0-3vulnerable
Ubuntusubversion20.041.13.0-3ubuntu0.1fixed
Susesubversionlinux enterprise high performance computing 15-espos1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise high performance computing 15-ltss1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise high performance computing 15 sp1-espos1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise high performance computing 15 sp1-ltss1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise high performance computing 15 sp2-espos1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise high performance computing 15 sp2-ltss1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise real time 15 sp21.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise server 15-ltss1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise server 15 sp1-bcl1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise server 15 sp1-ltss1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise server 15 sp2-bcl1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise server 15 sp2-ltss1.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise server for sap applications 151.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise server for sap applications 15 sp11.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise server for sap applications 15 sp21.10.6-150000.3.21.1fixed
Susesubversionmanager proxy 4.11.10.6-150000.3.21.1fixed
Susesubversionmanager retail branch server 4.11.10.6-150000.3.21.1fixed
Susesubversionmanager server 4.11.10.6-150000.3.21.1fixed
Susesubversionenterprise storage 61.10.6-150000.3.21.1fixed
Susesubversionenterprise storage 71.10.6-150000.3.21.1fixed
Susesubversionlinux enterprise software development kit 12 sp51.10.6-3.6.1fixed
Susesubversionlinux enterprise module for basesystem 15 sp31.10.6-150300.10.8.1fixed
Susesubversionlinux enterprise module for development tools 15 sp31.10.6-150300.10.8.1fixed
Susesubversionlinux enterprise module for server applications 15 sp31.10.6-150300.10.8.1fixed
Opensusesubversionleap 15.31.10.6-150300.10.8.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiansubversionsourcesid1.14.2-1not yet assignedNot reportedNot reported
Debiansubversionsourceforky1.14.2-1not yet assignedNot reportedNot reported
Debiansubversionsourcetrixie1.14.2-1not yet assignedNot reportedNot reported
Debiansubversionsourcebookworm1.14.2-1not yet assignedNot reportedNot reported
Alpinesubversionapk3.131.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.141.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.151.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.161.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.171.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.181.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.191.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.201.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.211.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.221.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.231.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Alpinesubversionapk3.241.14.2-r0Not reportedALPINE-CVE-2021-28544Not reported
Ubuntusubversiondeb20.041.13.0-3ubuntu0.1Not reportedUBUNTU-CVE-2021-28544Not reported
Ubuntusubversiondeb22.041.14.1-3ubuntu0.22.04.1Not reportedUBUNTU-CVE-2021-28544Not reported
Ubuntusubversiondeb22.041.14.1-3ubuntu0.22.04.1Not reportedUSN-5450-1Not reported
Ubuntusubversiondeb20.041.13.0-3ubuntu0.1Not reportedUSN-5372-1Not reported
Susesubversionrpmlinux enterprise high performance computing 15-espos1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise high performance computing 15-ltss1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise high performance computing 15 sp1-espos1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise high performance computing 15 sp1-ltss1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise high performance computing 15 sp2-espos1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise high performance computing 15 sp2-ltss1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise real time 15 sp21.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise server 15-ltss1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise server 15 sp1-bcl1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise server 15 sp1-ltss1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise server 15 sp2-bcl1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise server 15 sp2-ltss1.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise server for sap applications 151.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise server for sap applications 15 sp11.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise server for sap applications 15 sp21.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmmanager proxy 4.11.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmmanager retail branch server 4.11.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmmanager server 4.11.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmenterprise storage 61.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmenterprise storage 71.10.6-150000.3.21.1Not reportedSUSE-SU-2022:1161-1Not reported
Susesubversionrpmlinux enterprise software development kit 12 sp51.10.6-3.6.1Not reportedSUSE-SU-2022:1483-1Not reported
Susesubversionrpmlinux enterprise module for basesystem 15 sp31.10.6-150300.10.8.1Not reportedSUSE-SU-2022:1162-1Not reported
Susesubversionrpmlinux enterprise module for development tools 15 sp31.10.6-150300.10.8.1Not reportedSUSE-SU-2022:1162-1Not reported
Susesubversionrpmlinux enterprise module for server applications 15 sp31.10.6-150300.10.8.1Not reportedSUSE-SU-2022:1162-1Not reported
Opensusesubversionrpmleap 15.31.10.6-150300.10.8.1Not reportedSUSE-SU-2022:1162-1Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache2-mod-svn]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [libsvn1]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [libsvn-dev]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [libsvn-doc]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · all · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · all · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [libsvn-java]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [libsvn-perl]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [python3-subversion]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [ruby-svn]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [subversion]Fixed
    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

  • [subversion-tools]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.2-4+deb12u1 · amd64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

    • 1.14.2-4+deb12u1 · arm64 · bookworm

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · bookworm; dsa · subversion · debian · 12

[Debian 13 (Trixie)]

  • [libapache2-mod-svn]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [libsvn1]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [libsvn-dev]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [libsvn-doc]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · all · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · all · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [libsvn-java]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [libsvn-perl]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [python3-subversion]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [ruby-svn]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [subversion]Fixed
    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

  • [subversion-tools]Fixed

    Source package: [subversion]

    Details (2)

    • 1.14.5-3 · amd64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

    • 1.14.5-3 · arm64 · trixie

      Fixed · Fixed: 1.14.2-1

      dsa · subversion · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]