openSUSE Build Service

Ana Guerrero (anag+factory) accepted request 1156860 from

Samuel Cabrero (scabrero) 24 days ago (revision 170)

Ana Guerrero (anag+factory) accepted request 1134351 from

Dirk Mueller (dirkmueller) 4 months ago (revision 169)

- update to 1.21.2 (bsc#1218211, CVE-2023-39975):
  * Fix double-free in KDC TGS processing [CVE-2023-39975].

- update to 1.21.1 (CVE-2023-36054):
    with Windows KDCs.

Ana Guerrero (anag+factory) accepted request 1114991 from

Samuel Cabrero (scabrero) 7 months ago (revision 168)

Ana Guerrero (anag+factory) accepted request 1098841 from

Dirk Mueller (dirkmueller) 10 months ago (revision 167)

- update to 1.121.1 (CVE-2023-36054):
  * Fix potential uninitialized pointer free in kadm5 XDR parsing
    [CVE-2023-36054].
  * Added a credential cache type providing compatibility with
    the macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key
    from a GSS context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new
    allow_rc4 or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a
    session_enctypes string attribute.
  * Support for PAC full KDC checksums has been added to
    mitigate an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set
    of supported CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support,
    and the PKINIT module.
  * Modernized the KDC code for processing TGS requests,
    the code for encrypting and decrypting key data,
    the PAC handling code, and the GSS library packet
    parsing and composition code.
  * Improved the test framework's detection of memory
    errors in daemon processes when used with asan.