UbuntuUpdates.org

Package "krb5"

Name: krb5

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • MIT Kerberos master server (kadmind)
  • MIT Kerberos GSS Sample applications
  • TLS plugin for MIT Kerberos
  • MIT Kerberos key server (KDC)
Latest version: 1.17-6ubuntu4.8
Release: focal (20.04)
Level: security
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "krb5" in Focal

Repository Area Version
base main 1.17-6ubuntu4
base universe 1.17-6ubuntu4
security main 1.17-6ubuntu4.6
updates universe 1.17-6ubuntu4.8
updates main 1.17-6ubuntu4.8

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.17-6ubuntu4.8 2025-02-05 06:06:50 UTC

  krb5 (1.17-6ubuntu4.8) focal-security; urgency=medium

  * SECURITY UPDATE: Use of MD5-based message authentication over plaintext
    communications could lead to forgery attacks.
    - debian/patches/CVE-2024-3596.patch: Secure Response Authenticator
      by adding support for the Message-Authenticator attribute in non-EAP
      authentication methods.
    - debian/patches/0018-Convert-OTP-and-kdcproxy-tests-to-python3.patch:
      Convert tests/t_otp.py to python 3. Remove util/paste-kdcproxy.py and
      refactor it into util/wsgiref-kdcproxy.py to avoid paste dependency.
    - debian/patches/0019-More-python3-fixes-for-t_daemon.py: Replace a map
      with a list comprehension and update calls to StringIO in
      lib/krad/t_daemon.py.
    - CVE-2024-3596
  * Update libk5crypto3 symbols: add k5_hmac_md5 symbol.

 -- Nicolas Campuzano Jimenez <email address hidden> Sat, 25 Jan 2025 17:18:49 -0500
Source diff to previous version
CVE-2024-3596 RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject,

Version: 1.17-6ubuntu4.6 2024-08-08 17:07:11 UTC

  krb5 (1.17-6ubuntu4.6) focal-security; urgency=medium

  * SECURITY UPDATE: Invalid token requests
    - debian/patches/CVE-2024-37370.patch: Fix vulnerabilities in GSS
    message token handling
    - CVE-2024-37370
    - CVE-2024-37371

 -- Bruce Cable <email address hidden> Mon, 15 Jul 2024 13:47:15 +1000
Source diff to previous version
CVE-2024-37370 In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the
CVE-2024-37371 In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens wi

Version: 1.17-6ubuntu4.4 2023-11-06 11:13:38 UTC

  krb5 (1.17-6ubuntu4.4) focal-security; urgency=medium

  * SECURITY UPDATE: freeing of uninitialized memory
    - debian/patches/CVE-2023-36054.patch: ensure array count consistency in
      kadm5 RPC.
    - CVE-2023-36054

 -- Camila Camargo de Matos <email address hidden> Tue, 24 Oct 2023 13:53:43 -0300
Source diff to previous version
CVE-2023-36054 lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated u

Version: 1.17-6ubuntu4.3 2023-03-17 05:07:03 UTC

  krb5 (1.17-6ubuntu4.3) focal-security; urgency=medium

  * SECURITY UPDATE: Null pointer dereference issue
    - debian/patches/CVE-2021-36222.patch: Fix KDC null deref on bad
      encrypted challenge
    - debian/patches/CVE-2021-37750.patch: Fix KDC null deref on TGS inner
      body null server
    - CVE-2021-36222
    - CVE-2021-37750

 -- Nishit Majithia <email address hidden> Wed, 15 Mar 2023 19:47:40 +0530
Source diff to previous version
CVE-2021-36222 ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows rem
CVE-2021-37750 The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_re

Version: 1.17-6ubuntu4.2 2023-01-25 20:07:03 UTC

  krb5 (1.17-6ubuntu4.2) focal-security; urgency=medium

  * SECURITY UPDATE: Integer overflow
    - debian/patches/CVE-2022-42898.patch: add buffer length checks in
      krb5_pac_parse() in src/lib/krb5/krb/pac.c and a test case for
      invalid buffers in src/lib/krb5/krb/t_pac.c.
    - CVE-2022-42898

 -- Rodrigo Figueiredo Zaiden <email address hidden> Fri, 20 Jan 2023 08:14:35 -0300
CVE-2022-42898 PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC,


About   -   Send Feedback to @ubuntu_updates