Bug 1306431 - Fix for CVE-2015-3184 breaks mod_authz_svn so that it doesn't work with mod_auth_kerb
Fix for CVE-2015-3184 breaks mod_authz_svn so that it doesn't work with mod_a...
Status: ON_QA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: subversion (Show other bugs)
7.2
All Linux
unspecified Severity high
: rc
: ---
Assigned To: Joe Orton
qe-baseos-daemons
: Regression
Depends On:
Blocks: 1298243 1400961 1420851 1465904 1466370 1472751
  Show dependency treegraph
 
Reported: 2016-02-10 15:57 EST by Frank Hirtz
Modified: 2017-10-24 12:17 EDT (History)
1 user (show)

See Also:
Fixed In Version: subversion-1.7.14-13.el7
Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed:
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)
"ported" patch (1.74 KB, patch)
2016-02-10 15:57 EST, Frank Hirtz
no flags Details | Diff

  None (edit)
Description Frank Hirtz 2016-02-10 15:57:28 EST
Created attachment 1122910 [details]
"ported" patch

Description of problem:

URL: http://svn.apache.org/viewvc?rev=1708699&view=rev

The fix for CVE-2015-3184 (Subversion) and CVE-2015-3185 (httpd) broke
the use of 3rd party modules such as mod_auth_kerb and mod_auth_ntlm
when mandatory authn was combined with mod_authz_svn.  The problem
was httpd returned a 401 response without an Authentication header
meaning the client was unable to authenticate.  By returning DECLINED
we allow the authn module to generate a 401 with the correct headers.

Version-Release number of selected component (if applicable):
subversion-1.7.14-10

How reproducible:
Always

Steps to Reproduce:
Set up an SVN repository and HTTP server with Kerberos authentication. See https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=799105 for a sample config reproducer. Without the patch, you would get an unauthorized error. With the patch, you should get authenticated.

Note You need to log in before you can comment on or make changes to this bug.