Hide Forgot
Created attachment 1122910 [details] "ported" patch Description of problem: URL: http://svn.apache.org/viewvc?rev=1708699&view=rev The fix for CVE-2015-3184 (Subversion) and CVE-2015-3185 (httpd) broke the use of 3rd party modules such as mod_auth_kerb and mod_auth_ntlm when mandatory authn was combined with mod_authz_svn. The problem was httpd returned a 401 response without an Authentication header meaning the client was unable to authenticate. By returning DECLINED we allow the authn module to generate a 401 with the correct headers. Version-Release number of selected component (if applicable): subversion-1.7.14-10 How reproducible: Always Steps to Reproduce: Set up an SVN repository and HTTP server with Kerberos authentication. See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799105 for a sample config reproducer. Without the patch, you would get an unauthorized error. With the patch, you should get authenticated.
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2018:0938