Bugzilla – Bug 1142545
mod_auth_kerb segmentation fault when using basic authentication
Last modified: 2022-11-28 17:15:03 UTC
Created attachment 811365 [details] mod_auth_kerb.c patch A segmentation fault is triggered in function authenticate_user_krb5pwd() when credentials are supplied using basic authentication. A description of the bug and patch (attached to this report) is described at: https://sourceforge.net/p/modauthkerb/bugs/61/ Since mod_auth_kerb is not being actively developed, it would be convenient if the patch was applied through the openSUSE build. The source RPM already includes numerous patches to the mod_auth_kerb source.
Thanks for the report, reassigning to the package maintainer. (In reply to Tom Coogan from comment #0) > Since mod_auth_kerb is not being actively developed, it would be convenient > if the patch was applied through the openSUSE build. The source RPM already > includes numerous patches to the mod_auth_kerb source. I would recommend to drop it from openSUSE:Factory then (it was even dropped in SLE between 12 and 15). apache2-mod_auth_kerb can remain in Apache:Modules built for whatever openSUSE and SUSE version.
I submitted the patch for openSUSE:Leap:15/15.1 (mr#718260) and for Apache:Modules (sr#718261). Petr is right, if mod_auth_kerb is not maintained by upstream anymore, it's pointless to keep it in Factory. I opened a request for deletion from Factory (req#718259). It can stay in Apache:Modules for hard-core fans.
This is an autogenerated message for OBS integration: This bug (1142545) was mentioned in https://build.opensuse.org/request/show/718260 15.0+15.1 / apache2-mod_auth_kerb
openSUSE-RU-2019:1953-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1142545 CVE References: Sources used: openSUSE Leap 15.1 (src): apache2-mod_auth_kerb-5.4-lp151.3.3.1 openSUSE Leap 15.0 (src): apache2-mod_auth_kerb-5.4-lp150.2.3.1
openSUSE-RU-2019:2006-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1142545 CVE References: Sources used: openSUSE Backports SLE-15-SP1 (src): apache2-mod_auth_kerb-5.4-bp151.4.3.1 openSUSE Backports SLE-15 (src): apache2-mod_auth_kerb-5.4-bp150.3.3.1
openSUSE-RU-2020:0130-1: An update that has one recommended fix can now be installed. Category: recommended (moderate) Bug References: 1142545 CVE References: Sources used: openSUSE Backports SLE-15-SP1 (src): apache2-mod_auth_kerb-5.4-bp151.4.6.1
This is an autogenerated message for OBS integration: This bug (1142545) was mentioned in https://build.opensuse.org/request/show/1038742 Backports:SLE-15-SP4 / apache2-mod_auth_kerb