CVE catalog

CVE-2024-45720

subversion: CVE-2024-45720

Severity: Low
Published: Oct 8, 2024, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.61% · Oct 25, 2026

On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's executables (e.g., svn.exe, etc.) may lead to unexpected command line argument interpretation, including argument injection and execution of other programs, if a specially crafted command line argument string is processed. All versions of Subversion up to and including Subversion 1.14.3 are affected on Windows platforms only. Users are recommended to upgrade to version Subversion 1.14.4, which fixes this issue. Subversion is not affected on UNIX-like platforms.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	subversion	sid	`1.14.5-6`	not affected
Debian	subversion	forky	`1.14.5-6`	not affected
Debian	subversion	trixie	`1.14.5-3`	not affected
Debian	subversion	bookworm	`1.14.2-4+deb12u1`	not affected
Alpine	subversion	3.18	`1.14.5-r0`	fixed
Alpine	subversion	3.19	`1.14.5-r0`	fixed
Alpine	subversion	3.20	`1.14.5-r0`	fixed
Alpine	subversion	3.21	`1.14.4-r0`	fixed
Alpine	subversion	3.22	`1.14.4-r0`	fixed
Alpine	subversion	3.23	`1.14.4-r0`	fixed
Alpine	subversion	3.24	`1.14.4-r0`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	subversion	source	sid	`Not affected`	unimportant	Not reported	Not reported
Debian	subversion	source	forky	`Not affected`	unimportant	Not reported	Not reported
Debian	subversion	source	trixie	`Not affected`	unimportant	Not reported	Not reported
Debian	subversion	source	bookworm	`Not affected`	unimportant	Not reported	Not reported
Alpine	subversion	apk	3.18	`1.14.5-r0`	Not reported	ALPINE-CVE-2024-45720	Not reported
Alpine	subversion	apk	3.19	`1.14.5-r0`	Not reported	ALPINE-CVE-2024-45720	Not reported
Alpine	subversion	apk	3.20	`1.14.5-r0`	Not reported	ALPINE-CVE-2024-45720	Not reported
Alpine	subversion	apk	3.21	`1.14.4-r0`	Not reported	ALPINE-CVE-2024-45720	Not reported
Alpine	subversion	apk	3.22	`1.14.4-r0`	Not reported	ALPINE-CVE-2024-45720	Not reported
Alpine	subversion	apk	3.23	`1.14.4-r0`	Not reported	ALPINE-CVE-2024-45720	Not reported
Alpine	subversion	apk	3.24	`1.14.4-r0`	Not reported	ALPINE-CVE-2024-45720	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[libapache2-mod-svn]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[libsvn1]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[libsvn-dev]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[libsvn-doc]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · all · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · all · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[libsvn-java]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[libsvn-perl]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[python3-subversion]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[ruby-svn]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[subversion]Not affected
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
[subversion-tools]Not affected
Source package: [subversion]
Details (2)
- 1.14.2-4+deb12u1 · amd64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm
- 1.14.2-4+deb12u1 · arm64 · bookworm
  Not affected
  dsa · subversion · debian · bookworm

Observed: Oct 27, 2026, 1:34:27 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]