UnratedFix available
subversion — security advisory
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
- Products
- subversion
- Affected versions
- Not specified
- Fixed versions
- 1.8.10-1
- CVEs
- CVE-2014-3528
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 21:37 UTC · Revision 1
Source evidence
Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.
osv:DEBIAN-CVE-2014-3528
subversion
Fixed versions: 1.8.10-1
subversion
Fixed versions: 1.8.10-1
subversion
Fixed versions: 1.8.10-1
Complete source record
{
"id": "ece20ced6c21f2206d15be1f79d7b91817b7b6350b917ac0ac11e60ab4bc8ced",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2014-3528",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2014-3528",
"summary": "Apache Subversion 1.0.0 through 1.7.x before 1.7.17 and 1.8.x before 1.8.10 uses an MD5 hash of the URL and authentication realm to store cached credentials, which makes it easier for remote servers to obtain the credentials via a crafted authentication realm.",
"evidence": "osv:DEBIAN-CVE-2014-3528",
"products": [
{
"name": {
"value": "subversion",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.8.10-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "subversion",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.8.10-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "subversion",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1.8.10-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "unknown",
"structured": {
"id": "DEBIAN-CVE-2014-3528",
"aliases": [
"DEBIAN-CVE-2014-3528"
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.10-1"
}
]
}
],
"package": {
"name": "subversion",
"purl": "pkg:deb/debian/subversion?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-3528.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.10-1"
}
]
}
],
"package": {
"name": "subversion",
"purl": "pkg:deb/debian/subversion?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-3528.json"
},
"ecosystem_specific": {
"urgency": "low"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1.8.10-1"
}
]
}
],
"package": {
"name": "subversion",
"purl": "pkg:deb/debian/subversion?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2014-3528.json"
},
"ecosystem_specific": {
"urgency": "low"
}
}
],
"modified": "2026-10-23T15:47:24.992454630Z",
"provider": "osv",
"upstream": [
"CVE-2014-3528"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2014-3528"
]
},
"related_cves": [
{
"value": "CVE-2014-3528",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": null
},
"source_id": "core-osv",
"document_id": 413818,
"published_at": "2014-08-19T18:55:02.687+00:00"
}