DSA-3137-1 websvn -- security update

Debian Security Advisory

DSA-3137-1 websvn -- security update

Date Reported:

24 Jan 2015

Affected Packages:

websvn

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 775682.
In Mitre's CVE dictionary: CVE-2013-6892.

More information:

James Clawson discovered that websvn, a web viewer for Subversion repositories, would follow symlinks in a repository when presenting a file for download. An attacker with repository write access could thereby access any file on disk readable by the user the webserver runs as.

For the stable distribution (wheezy), this problem has been fixed in version 2.3.3-1.1+deb7u1.

For the unstable distribution (sid), this problem has been fixed in version 2.3.3-1.2.

We recommend that you upgrade your websvn packages.