Package "krb5-otp"
| Name: |
krb5-otp
|
Description: |
OTP plugin for MIT Kerberos
|
| Latest version: |
1.16-2ubuntu0.4 |
| Release: |
bionic (18.04) |
| Level: |
security |
| Repository: |
universe |
| Head package: |
krb5 |
| Homepage: |
http://web.mit.edu/kerberos/ |
Links
Download "krb5-otp"
Other versions of "krb5-otp" in Bionic
Changelog
|
krb5 (1.16-2ubuntu0.4) bionic-security; urgency=medium
* SECURITY UPDATE: Null pointer dereference issue
- debian/patches/CVE-2021-36222.patch: Fix KDC null deref on bad
encrypted challenge
- debian/patches/CVE-2021-37750.patch: Fix KDC null deref on TGS inner
body null server
- CVE-2021-36222
- CVE-2021-37750
-- Nishit Majithia <email address hidden> Wed, 15 Mar 2023 19:38:38 +0530
|
| Source diff to previous version |
| CVE-2021-36222 |
ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows rem |
| CVE-2021-37750 |
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_re |
|
|
krb5 (1.16-2ubuntu0.3) bionic-security; urgency=medium
* SECURITY UPDATE: Integer overflow
- debian/patches/CVE-2022-42898.patch: add buffer length checks in
krb5_pac_parse() in src/lib/krb5/krb/pac.c and a test case for
invalid buffers in src/lib/krb5/krb/t_pac.c.
- CVE-2022-42898
* SECURITY UPDATE: DoS (crash) the KDC by making an S4U2Self request
- debian/patches/CVE-2018-20217-1.patch: Ignore password attributes for
S4U2Self requests.
- debian/patches/CVE-2018-20217-2.patch: remove incorrect KDC assertion.
- CVE-2018-20217
-- Rodrigo Figueiredo Zaiden <email address hidden> Fri, 20 Jan 2023 07:37:35 -0300
|
| Source diff to previous version |
| CVE-2022-42898 |
PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, |
| CVE-2018-20217 |
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an ol |
|
|
krb5 (1.16-2ubuntu0.2) bionic-security; urgency=medium
* SECURITY UPDATE: Unbounded recursion
- debian/patches/CVE-2020-28196.patch: adds recursion limit for ASN.1
indefinite lenghts in src/lib/krb5/asn.1/asn1_encode.c.
- CVE-2020-28196
-- <email address hidden> (Leonidas S. Barbosa) Wed, 11 Nov 2020 11:23:49 -0300
|
| Source diff to previous version |
| CVE-2020-28196 |
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb |
|
|
krb5 (1.16-2ubuntu0.1) bionic-security; urgency=medium
* SECURITY UPDATE: Authenticated kadmin with permission to add principals
to an LDAP Kerberos can DoS or bypass DN container check.
- debian/patches/CVE-2018-5729-CVE-2018-5730.patch: Fix flaws in LDAP DN
checking
- CVE-2018-5729
- CVE-2018-5730
-- Eduardo Barretto <email address hidden> Fri, 11 Jan 2019 13:48:01 -0200
|
| CVE-2018-5729 |
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NUL |
| CVE-2018-5730 |
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership |
|
About
-
Send Feedback to @ubuntu_updates
