UbuntuUpdates.org

Package "krb5-k5tls"

Name: krb5-k5tls

Description:

TLS plugin for MIT Kerberos
Latest version: 1.17-6ubuntu4.11
Release: focal (20.04)
Level: security
Repository: universe
Head package: krb5
Homepage: http://web.mit.edu/kerberos/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "krb5-k5tls"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "krb5-k5tls" in Focal

Repository Area Version
base universe 1.17-6ubuntu4
updates universe 1.17-6ubuntu4.11

Changelog

Version: 1.17-6ubuntu4.3 2023-03-17 05:07:03 UTC

  krb5 (1.17-6ubuntu4.3) focal-security; urgency=medium

  * SECURITY UPDATE: Null pointer dereference issue
    - debian/patches/CVE-2021-36222.patch: Fix KDC null deref on bad
      encrypted challenge
    - debian/patches/CVE-2021-37750.patch: Fix KDC null deref on TGS inner
      body null server
    - CVE-2021-36222
    - CVE-2021-37750

 -- Nishit Majithia <email address hidden> Wed, 15 Mar 2023 19:47:40 +0530
Source diff to previous version
CVE-2021-36222 ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows rem
CVE-2021-37750 The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_re

Version: 1.17-6ubuntu4.2 2023-01-25 20:07:03 UTC

  krb5 (1.17-6ubuntu4.2) focal-security; urgency=medium

  * SECURITY UPDATE: Integer overflow
    - debian/patches/CVE-2022-42898.patch: add buffer length checks in
      krb5_pac_parse() in src/lib/krb5/krb/pac.c and a test case for
      invalid buffers in src/lib/krb5/krb/t_pac.c.
    - CVE-2022-42898

 -- Rodrigo Figueiredo Zaiden <email address hidden> Fri, 20 Jan 2023 08:14:35 -0300
Source diff to previous version
CVE-2022-42898 PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC,

Version: 1.17-6ubuntu4.1 2020-11-17 16:07:53 UTC

  krb5 (1.17-6ubuntu4.1) focal-security; urgency=medium

  * SECURITY UPDATE: Unbounded recursion
    - debian/patches/CVE-2020-28196.patch: adds recursion limit for ASN.1
      indefinite lenghts in src/lib/krb5/asn.1/asn1_encode.c.
    - CVE-2020-28196

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 11 Nov 2020 11:23:12 -0300
CVE-2020-28196 MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb


About   -   Send Feedback to @ubuntu_updates