[
https://issues.apache.org/jira/browse/SVN-4673?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Johan Corveleyn closed SVN-4673.
--------------------------------
As of version 1.8.18, 1.9.6 and 1.10, Subversion rejects commits which create
SHA1 collisions, if the server is configured with rep-sharing enabled (which is
the default). See http://subversion.apache.org/faq.html#shattered-sha1 for more
information.
> Reports of SHA-1 collision causing repository breakage
> ------------------------------------------------------
>
> Key: SVN-4673
> URL: https://issues.apache.org/jira/browse/SVN-4673
> Project: Subversion
> Issue Type: Bug
> Reporter: Bryan Rosander
> Priority: Critical
> Fix For: 1.8.18, 1.9.6, 1.10.0
>
>
> Google recently created two pdfs with the same sha-1 checksum [1]. There are
> reports of this breaking svn repositories[2][3].
> [1]
> https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
> [2]
> https://arstechnica.com/security/2017/02/watershed-sha1-collision-just-broke-the-webkit-repository-others-may-follow/
> [3] https://lists.webkit.org/pipermail/webkit-dev/2017-February/028795.html
> Additional resources:
> [https://bugs.webkit.org/show_bug.cgi?id=168774#c23<Paste>]
> https://shattered.io/
--
This message was sent by Atlassian JIRA
(v6.4.14#64029)
