Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Apache Subversion allows login bypass with crafted realm

CVE-2016-2167 · published 10 years ago
Summary

If you use Apache Subversion versions before 1.8.16 or 1.9.4 with Cyrus SASL authentication, an attacker can trick the server into accepting a username they should not have access to by sending a specially formed realm string. This lets them get past the normal repository access controls. Update Subversion to the latest release or switch to a different authentication method to close the gap.

What to do
  • Update debian subversion to version 1.9.4-1.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian subversion < 1.9.4-1
Fix: upgrade to 1.9.4-1
Debian:13 debian subversion < 1.9.4-1
Fix: upgrade to 1.9.4-1
Debian:14 debian subversion < 1.9.4-1
Fix: upgrade to 1.9.4-1
– apache subversion <= 1.8.15
1.9.0
1.9.1
1.9.2
1.9.3
cpe:2.3:a:apache:subversion:*:*:*:*:*:*:*:*
Original advisory text
The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticat...
The canonicalize_username function in svnserve/cyrus_auth.c in Apache Subversion before 1.8.16 and 1.9.x before 1.9.4, when Cyrus SASL authentication is used, allows remote attackers to authenticate and bypass intended access restrictions via a realm string that is a prefix of an expected repository realm string.
References
Severity
6.8 Medium
Exploitation
7% chance of attack within 30 days
Type
CWE-284Improper Access Control
Timeline
Published5 May 2016
Updated4 Nov 2026
First seen22 Sep 2026
Sources
DEBIAN-CVE-2016-2167 · OSV
CVE-2016-2167 · NVD
Track software like this
Free during beta