CVE-2017-9800: A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and

Q: How do I fix CVE-2017-9800?

subversion: upgrade to newer than 1.8.18. Exact commands for each OS are on this page.

Q: Is CVE-2017-9800 being exploited?

CVE-2017-9800 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

Q: What does CVE-2017-9800 affect?

CVE-2017-9800 affects subversion. Severity is critical (CVSS 9.8). A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malic

Q: How urgent is CVE-2017-9800?

Priority 69/100. Critical severity; EPSS top 3%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist

This week

CRITICAL 9.8REMOTEWATCHLISTUPGRADE

CVE-2017-9800 is a critical-severity flaw (CVSS 9.8) affecting subversion. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malicious user committing to a honest server (to attack another user of that server's repositories), or by a proxy server. The vulnerability affects all clients, including those that use file://, http://, and plain

Why this priority

Critical severity
EPSS top 3%: very likely to be exploited
Remotely exploitable, no login, no user action
On your watchlist

A fixed release or distro patch exists.

Risk facts

CVSS score	9.8 (Critical)
Attack vector	Network (remote)
Attack complexity	Low
Privileges needed	None
User interaction	None
EPSS exploit chance	18.9% (top 3%)
CISA exploited list	No
Weakness	CWE-20
Published	2017-08-11
Last modified	2026-06-17

Publisher (CNA): Apache Software Foundation · Vendor: apache

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

2017-08-11 21:29 UTCPublished CVE record published
2026-06-17 01:28 UTCUpdated Record last modified

apache subversion UPGRADE

Affected: <= 1.8.18 · 1.9.0 · 1.9.1 · 1.9.2 · 1.9.3 · 1.9.4 · 1.9.5 · 1.9.6

Fixed in: newer than 1.8.18

Safe to downgrade to: no unaffected older release

1. Check installed version

apt-cache policy subversion || rpm -q subversion || subversion --version

2. UPGRADE to newer than 1.8.18 (Debian / Ubuntu)

sudo apt update && sudo apt install --only-upgrade subversion

2. UPGRADE (RHEL / Amazon Linux / Fedora)

sudo dnf upgrade subversion

Note

Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.

Exact fixes by distribution

Fedora ELN · fuse-sshfs · FIXED · 3.7.6-3.eln159 · FEDORA-2026-bcb7be7c5c · source

sudo dnf upgrade --advisory=FEDORA-2026-bcb7be7c5c

Fedora 46 · python-odata-query · FIXED · 0.10.1-1.fc46 · FEDORA-2026-eab44dc513 · source

sudo dnf upgrade --advisory=FEDORA-2026-eab44dc513

Debian 12 · subversion · FIXED · 1.9.7-1

sudo apt update && sudo apt install --only-upgrade subversion dpkg --compare-versions "$(dpkg-query -W -f='${Version}' subversion)" ge "1.9.7-1" && echo PATCHED || echo STILL-VULNERABLE

Debian 13 · subversion · FIXED · 1.9.7-1

sudo apt update && sudo apt install --only-upgrade subversion dpkg --compare-versions "$(dpkg-query -W -f='${Version}' subversion)" ge "1.9.7-1" && echo PATCHED || echo STILL-VULNERABLE

RHEL 7 · subversion · FIXED · subversion-1.7.14-11.el7_4

sudo dnf upgrade --advisory=RHSA-2017:2480 rpm -q subversion

RHEL 5 · subversion · DEFERRED

RHEL 6 · subversion · DEFERRED

Alpine 3.20 · subversion · FIXED · subversion-1.9.7-r0

apk add --upgrade subversion apk info -v subversion

Alpine 3.21 · subversion · FIXED · subversion-1.9.7-r0

apk add --upgrade subversion apk info -v subversion

Alpine 3.22 · subversion · FIXED · subversion-1.9.7-r0

apk add --upgrade subversion apk info -v subversion

Alpine 3.23 · subversion · FIXED · subversion-1.9.7-r0

apk add --upgrade subversion apk info -v subversion

Amazon Linux 1 · see advisory · FIXED · ALAS-2017-883 · source

sudo yum update --advisory=ALAS-2017-883

Public exploits and detection

Public code exists for this CVE. Treat unpatched systems as at risk, and only run PoCs in a lab.

Write-up: hackerone.com/reports/260005
Write-up: www.oracle.com/security-alerts/cpuoct2020.html

Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2017-9800?

subversion: upgrade to newer than 1.8.18. Exact commands for each OS are on this page.

Is CVE-2017-9800 being exploited?

CVE-2017-9800 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2017-9800 affect?

CVE-2017-9800 affects subversion. Severity is critical (CVSS 9.8). A maliciously constructed svn+ssh:// URL would cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run an arbitrary shell command. Such a URL could be generated by a malicious server, by a malic

How urgent is CVE-2017-9800?

Priority 69/100. Critical severity; EPSS top 3%: very likely to be exploited; Remotely exploitable, no login, no user action; On your watchlist

Related CVEs

CVE-2024-46901 LOW 3.1 UPGRADE MITIGATE Insufficient validation of filenames against control characters in Apache Subversion repositories served via m
CVE-2024-45720 HIGH 8.2 UPGRADE On Windows platforms, a "best fit" character encoding conversion of command line arguments to Subversion's exe
CVE-2022-29048 MEDIUM 4.3 UPGRADE UPGRADE A cross-site request forgery (CSRF) vulnerability in Jenkins Subversion Plugin 2.15.3 and earlier allows attac
CVE-2022-29046 MEDIUM 5.4 UPGRADE UPGRADE Jenkins Subversion Plugin 2.15.3 and earlier does not escape the name and description of List Subversion tags
CVE-2022-24070 HIGH 7.5 UPGRADE MITIGATE Subversion's mod_dav_svn is vulnerable to memory corruption

References

← Back to latest CVEs