UbuntuUpdates.org

Package "krb5"

Name: krb5

Description:

This package is just an umbrella for a group of other packages, it has no description.
Description samples from packages in group:

  • MIT Kerberos master server (kadmind)
  • MIT Kerberos GSS Sample applications
  • TLS plugin for MIT Kerberos
  • MIT Kerberos key server (KDC)
Latest version: 1.17-6ubuntu4.11
Release: focal (20.04)
Level: updates
Repository: universe

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Other versions of "krb5" in Focal

Repository Area Version
base main 1.17-6ubuntu4
base universe 1.17-6ubuntu4
security main 1.17-6ubuntu4.11
security universe 1.17-6ubuntu4.11
updates main 1.17-6ubuntu4.11

Packages in group

Deleted packages are displayed in grey.


Changelog

Version: 1.17-6ubuntu4.11 2025-05-28 19:07:27 UTC

  krb5 (1.17-6ubuntu4.11) focal-security; urgency=medium

  * SECURITY UPDATE: Use of weak cryptographic hash.
    - debian/patches/CVE-2025-3576*.patch: Add allow_des3 and allow_rc4 options.
      Disallow usage of des3 and rc4 unless allowed in the config. Replace
      warn_des3 with warn_deprecated in ./src/lib/krb5/krb/get_in_tkt.c. Add
      allow_des3 and allow_rc4 boolean in ./src/include/k5-int.h. Prevent usage
      of deprecated enctypes in ./src/kdc/kdc_util.c.
    - debian/patches/CVE-2025-3576-post1.patch: Add enctype comparison with
      ENCTYPE_AES256_CTS_HMAC_SHA1_96 in ./src/kdc/kdc_util.c.
    - debian/libk5crypto3.symbols: Add krb5int_c_deprecated_enctype symbol.
    - CVE-2025-3576

 -- Hlib Korzhynskyy <email address hidden> Thu, 15 May 2025 17:02:09 +0200
Source diff to previous version
CVE-2025-3576 A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 che

Version: 1.17-6ubuntu4.9 2025-03-03 21:06:57 UTC

  krb5 (1.17-6ubuntu4.9) focal-security; urgency=medium

  * SECURITY UPDATE: denial of service via two memory leaks
    - debian/patches/CVE-2024-26458.patch: fix two unlikely memory leaks in
      src/lib/gssapi/krb5/k5sealv3.c, src/lib/rpc/pmap_rmt.c.
    - CVE-2024-26458
    - CVE-2024-26461
  * SECURITY UPDATE: kadmind DoS via iprop log file
    - debian/patches/CVE-2025-24528.patch: prevent overflow when
      calculating ulog block size in src/lib/kdb/kdb_log.c.
    - CVE-2025-24528

 -- Marc Deslauriers <email address hidden> Tue, 25 Feb 2025 12:27:13 -0500
Source diff to previous version
CVE-2024-26458 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
CVE-2024-26461 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
CVE-2025-24528 Prevent overflow when calculating ulog block size

Version: 1.17-6ubuntu4.8 2025-02-05 09:06:56 UTC

  krb5 (1.17-6ubuntu4.8) focal-security; urgency=medium

  * SECURITY UPDATE: Use of MD5-based message authentication over plaintext
    communications could lead to forgery attacks.
    - debian/patches/CVE-2024-3596.patch: Secure Response Authenticator
      by adding support for the Message-Authenticator attribute in non-EAP
      authentication methods.
    - debian/patches/0018-Convert-OTP-and-kdcproxy-tests-to-python3.patch:
      Convert tests/t_otp.py to python 3. Remove util/paste-kdcproxy.py and
      refactor it into util/wsgiref-kdcproxy.py to avoid paste dependency.
    - debian/patches/0019-More-python3-fixes-for-t_daemon.py: Replace a map
      with a list comprehension and update calls to StringIO in
      lib/krad/t_daemon.py.
    - CVE-2024-3596
  * Update libk5crypto3 symbols: add k5_hmac_md5 symbol.

 -- Nicolas Campuzano Jimenez <email address hidden> Sat, 25 Jan 2025 17:18:49 -0500
Source diff to previous version
CVE-2024-3596 RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject,

Version: 1.17-6ubuntu4.7 2024-08-22 21:07:10 UTC

  krb5 (1.17-6ubuntu4.7) focal; urgency=medium

  * Fix a memory leak in krb5_gss_inquire_cred (LP: #2060666)

 -- Ponnuvel Palaniyappan <email address hidden> Thu, 08 Aug 2024 11:06:56 +0100
Source diff to previous version
2060666 [SRU] Memory leak in krb5 version 1.17

Version: 1.17-6ubuntu4.6 2024-08-08 08:07:12 UTC

  krb5 (1.17-6ubuntu4.6) focal-security; urgency=medium

  * SECURITY UPDATE: Invalid token requests
    - debian/patches/CVE-2024-37370.patch: Fix vulnerabilities in GSS
    message token handling
    - CVE-2024-37370
    - CVE-2024-37371

 -- Bruce Cable <email address hidden> Mon, 15 Jul 2024 13:47:15 +1000
CVE-2024-37370 In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the
CVE-2024-37371 In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens wi


About   -   Send Feedback to @ubuntu_updates