CVE-2016-2167

What it actually does

The canonicalize_username function in svnserve/cyrus_auth.c performs a prefix match on the realm string during Cyrus SASL authentication, allowing an attacker-supplied realm that is a prefix of the expected repository realm to succeed and grant unintended access.

Why it matters to the business

Attackers can gain unauthorized read or write access to version-controlled repositories, risking exposure or tampering of source code and intellectual property; the flaw affects systems still running vulnerable Subversion versions with SASL enabled and carries elevated urgency due to its age and public knowledge.

How an attack unfolds

An attacker connects to an svnserve instance configured for Cyrus SASL, supplies a crafted realm string that matches only a prefix of the legitimate repository realm, and obtains an authenticated session that bypasses intended access controls without needing valid credentials.

How to fix it

Upgrade Apache Subversion to 1.8.16 or 1.9.4 or later; for helm-fips (Chainguard) apply the fixed package version 0 or later that bundles the corrected Subversion libraries.

How to confirm the fix worked

Verify the installed Subversion version is at least 1.8.16 or 1.9.4; test authentication with a non-matching prefix realm and confirm it is rejected; review SASL configuration to ensure realm strings are not relying on prefix semantics.

Typical attack path

1. Identify svnserve instances advertising Cyrus SASL authentication
2. Craft a connection request containing a realm string that is a prefix of the target repository realm
3. Complete SASL authentication using the prefix match
4. Perform Subversion operations (checkout, commit, etc.) under the unauthorized identity

How to detect it

Review svnserve and SASL logs for authentication events using realm strings that do not exactly match configured repository realms; look for successful commits or checkouts from unexpected client identities shortly after SASL negotiation.

What your security team should do

• Immediately inventory all Subversion deployments and confirm Cyrus SASL usage
• Prioritize upgrade of any instance running versions prior to 1.8.16 or 1.9.4
• Disable Cyrus SASL or switch to alternative authentication mechanisms until patches are applied
• Monitor vendor advisories for downstream packages such as helm-fips