UbuntuUpdates.org

Package "krb5-multidev"

Name: krb5-multidev

Description:

development files for MIT Kerberos without Heimdal conflict
Latest version: 1.19.2-2ubuntu0.6
Release: jammy (22.04)
Level: security
Repository: main
Head package: krb5
Homepage: http://web.mit.edu/kerberos/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "krb5-multidev"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "krb5-multidev" in Jammy

Repository Area Version
base main 1.19.2-2
updates main 1.19.2-2ubuntu0.6

Changelog

Version: 1.19.2-2ubuntu0.6 2025-03-03 17:06:57 UTC

  krb5 (1.19.2-2ubuntu0.6) jammy-security; urgency=medium

  * SECURITY UPDATE: denial of service via two memory leaks
    - debian/patches/CVE-2024-26458.patch: fix two unlikely memory leaks in
      src/lib/gssapi/krb5/k5sealv3.c, src/lib/rpc/pmap_rmt.c.
    - CVE-2024-26458
    - CVE-2024-26461
  * SECURITY UPDATE: kadmind DoS via iprop log file
    - debian/patches/CVE-2025-24528.patch: prevent overflow when
      calculating ulog block size in src/lib/kdb/kdb_log.c.
    - CVE-2025-24528

 -- Marc Deslauriers <email address hidden> Tue, 25 Feb 2025 12:26:06 -0500
Source diff to previous version
CVE-2024-26458 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
CVE-2024-26461 Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
CVE-2025-24528 Prevent overflow when calculating ulog block size

Version: 1.19.2-2ubuntu0.5 2025-02-05 06:06:52 UTC

  krb5 (1.19.2-2ubuntu0.5) jammy-security; urgency=medium

  * SECURITY UPDATE: Use of MD5-based message authentication over plaintext
    communications could lead to forgery attacks.
    - debian/patches/CVE-2024-3596.patch: Secure Response Authenticator
      by adding support for the Message-Authenticator attribute in non-EAP
      authentication methods.
    - CVE-2024-3596
  * Update libk5crypto3 symbols: add k5_hmac_md5 symbol.

 -- Nicolas Campuzano Jimenez <email address hidden> Mon, 27 Jan 2025 19:37:24 -0500
Source diff to previous version
CVE-2024-3596 RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject,

Version: 1.19.2-2ubuntu0.4 2024-08-08 06:07:11 UTC

  krb5 (1.19.2-2ubuntu0.4) jammy-security; urgency=medium

  * SECURITY UPDATE: Invalid token requests
    - debian/patches/CVE-2024-37370.patch: Fix vulnerabilities in GSS
    message token handling
    - CVE-2024-37370
    - CVE-2024-37371

 -- Bruce Cable <email address hidden> Mon, 15 Jul 2024 13:46:10 +1000
Source diff to previous version
CVE-2024-37370 In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the
CVE-2024-37371 In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens wi

Version: 1.19.2-2ubuntu0.3 2023-11-06 11:13:40 UTC

  krb5 (1.19.2-2ubuntu0.3) jammy-security; urgency=medium

  * SECURITY UPDATE: freeing of uninitialized memory
    - debian/patches/CVE-2023-36054.patch: ensure array count consistency in
      kadm5 RPC.
    - CVE-2023-36054

 -- Camila Camargo de Matos <email address hidden> Tue, 24 Oct 2023 13:59:06 -0300
Source diff to previous version

Version: 1.19.2-2ubuntu0.1 2023-01-25 20:07:06 UTC

  krb5 (1.19.2-2ubuntu0.1) jammy-security; urgency=medium

  * SECURITY UPDATE: Integer overflow
    - debian/patches/CVE-2022-42898.patch: add buffer length checks in
      krb5_pac_parse() in src/lib/krb5/krb/pac.c and a test case for
      invalid buffers in src/lib/krb5/krb/t_pac.c.
    - CVE-2022-42898

 -- Rodrigo Figueiredo Zaiden <email address hidden> Fri, 20 Jan 2023 08:34:37 -0300
CVE-2022-42898 PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC,


About   -   Send Feedback to @ubuntu_updates