Mailing-List: contact announce-help@subversion.apache.org; run by ezmlm
Precedence: bulk
Received-SPF: error (nike.apache.org: local policy)
MIME-Version: 1.0
Date: Fri, 31 May 2013 13:35:42 -0700
Message-ID: 
 <CADkdwvTxsMFeHgc8bK2V-2PrSrKoBffTi8+xbHA5tocrrewWew@mail.gmail.com>
Subject: Subversion 1.6.23 released
From: Ben Reser <breser@apache.org>
To: announce@subversion.apache.org, users@subversion.apache.org,
	Subversion Development <dev@subversion.apache.org>
Content-Type: text/plain; charset=ISO-8859-1

I'm happy to announce the release of Subversion 1.6.23.  Please note
that Subversion 1.6.23 is the next release after Subversion 1.6.21.
The 1.6.22 release was not published publicly, due to issues found
during testing.

Please choose the mirror closest to you by visiting:

    http://subversion.apache.org/download/#supported-releases

This release addresses three security issues:
    CVE-2013-1968: fsfs repository corruption caused by newline
characters in filenames
    CVE-2013-2088: contrib hook-scripts can allow arbitrary code execution
    CVE-2013-2112: svnserve remotely triggerable DoS.

More information on these vulnerabilities, including the relevent advisories
and potential attack vectors and workarounds, can be found on the Subversion
security website:
    http://subversion.apache.org/security/

The SHA1 checksums are:

    1530f5cf9edf0ba04114171ed7e835e955a2c0b6 subversion-1.6.23.tar.gz
    578c0ec69227db041e67ade40ac4cf2ebe2cf54a subversion-1.6.23.tar.bz2
    87b53fd12ff98171324ef2584d20c01419fb3608 subversion-1.6.23.zip

PGP Signatures are available at:

    http://subversion.tigris.org/downloads/subversion-1.6.23.tar.bz2.asc
    http://subversion.tigris.org/downloads/subversion-1.6.23.tar.gz.asc
    http://subversion.tigris.org/downloads/subversion-1.6.23.zip.asc

For this release, the following people have provided PGP signatures:

   Ben Reser [4096R/16A0DE01] with fingerprint:
    19BB CAEF 7B19 B280 A0E2  175E 62D4 8FAD 16A0 DE01
   C. Michael Pilato [4096R/FE681333] with fingerprint:
    753B 2F9D F717 FA23 A43E  E7C3 F5E0 F001 FE68 1333
   Ivan Zhakov [4096R/F6AD8147] with fingerprint:
    4829 8F0F E47F 4B8A 43FD  6525 919F 6F61 F6AD 8147
   Johan Corveleyn [4096R/010C8AAD] with fingerprint:
    8AA2 C10E EAAD 44F9 6972  7AEA B59C E6D6 010C 8AAD
   Paul T. Burba [4096R/56F3D7BC] with fingerprint:
    1A0F E7C6 B3C5 F8D4 D0C4  A20B 64DD C071 56F3 D7BC
   Philip Martin [2048R/ED1A599C] with fingerprint:
    A844 790F B574 3606 EE95  9207 76D7 88E1 ED1A 599C
   Stefan Sperling [2048R/9A59B973] with fingerprint:
    8BC4 DAE0 C5A4 D65F 4044  0107 4F7D BAA9 9A59 B973

Release notes for the 1.6.x release series may be found at:

    http://subversion.apache.org/docs/release-notes/1.6.html

You can find the list of changes between 1.6.23 and earlier versions at:

    http://svn.apache.org/repos/asf/subversion/tags/1.6.23/CHANGES

Questions, comments, and bug reports to users@subversion.apache.org.

Thanks,
- The Subversion Team