- Upgrade to 1.15.2
* Fix a KDC denial of service vulnerability caused by unset status
strings [CVE-2017-11368]
* Preserve GSS contexts on init/accept failure [CVE-2017-11462]
* Fix kadm5 setkey operation with LDAP KDB module
* Use a ten-second timeout after successful connection for HTTPS KDC
requests, as we do for TCP requests
* Fix client null dereference when KDC offers encrypted challenge
without FAST
* Ignore dotfiles when processing profile includedir directive
* Improve documentation
- Upgrade to 1.15.2
* Fix a KDC denial of service vulnerability caused by unset status
strings [CVE-2017-11368]
* Preserve GSS contexts on init/accept failure [CVE-2017-11462]
* Fix kadm5 setkey operation with LDAP KDB module
* Use a ten-second timeout after successful connection for HTTPS KDC
requests, as we do for TCP requests
* Fix client null dereference when KDC offers encrypted challenge
without FAST
* Ignore dotfiles when processing profile includedir directive
* Improve documentation
OBS-URL: https://build.opensuse.org/request/show/528703
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=196
in order to improve client security in handling service principle
names. (bsc#1054028)
- Set "rdns" and "dns_canonicalize_hostname" to false in krb5.conf
in order to improve client security in handling service principle
names. (bsc#1054028)
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=194
copying over some changelog texts from SLE package:
- bug#918595 owned by varkoly@suse.com: VUL-0: CVE-2014-5355
krb5: denial of service in krb5_read_message
- bug#912002 owned by varkoly@suse.com: VUL-0
CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423:
krb5: Vulnerabilities in kadmind, libgssrpc, gss_process_context_token
- bug#910458 owned by varkoly@suse.com: VUL-1
CVE-2014-5354: krb5: NULL pointer dereference when using keyless entries
- bug#928978 owned by varkoly@suse.com: VUL-0
CVE-2015-2694: krb5: issues in OTP and PKINIT kdcpreauth modules leading
to requires_preauth bypass
- bug#910457 owned by varkoly@suse.com: VUL-1
CVE-2014-5353: krb5: NULL pointer dereference when using a ticket policy
name as a password policy name
- bug#991088 owned by hguo@suse.com: VUL-1
CVE-2016-3120: krb5: S4U2Self KDC crash when anon is restricted
- bug#992853 owned by hguo@suse.com: krb5: bogus prerequires
- [fate#320326](https://fate.suse.com/320326)
- bug#982313 owned by pgajdos@suse.com: Doxygen unable to resolve reference
from \cite
- There is no change made about the package itself, this is only
copying over some changelog texts from SLE package:
- bug#918595 owned by varkoly@suse.com: VUL-0: CVE-2014-5355
krb5: denial of service in krb5_read_message
- bug#912002 owned by varkoly@suse.com: VUL-0
CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423:
krb5: Vulnerabilities in kadmind, libgssrpc, gss_process_context_token
- bug#910458 owned by varkoly@suse.com: VUL-1
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=191
- Remove source file ccapi/common/win/OldCC/autolock.hxx
that is not needed and does not carry an acceptable license.
(bsc#968111)
------------------------------------------------------------------
- Remove source file ccapi/common/win/OldCC/autolock.hxx
that is not needed and does not carry an acceptable license.
(bsc#968111)
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=168
- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
(bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
(bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
(bsc#963964)
OBS-URL: https://build.opensuse.org/request/show/357309
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=158
krb5-1.12-CVE-2014-4341-CVE-2014-4342.patch
- start krb5kdc after slapd (bnc#886102)
- obsolete krb5-plugin-preauth-pkinit-nss (bnc#881674)
similar functionality is provided by krb5-plugin-preauth-pkinit
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=121
* Make KDC log service principal names more consistently during
some error conditions, instead of "<unknown server>"
* Fix several bugs related to building AES-NI support on less
common configurations
* Fix several bugs related to keyring credential caches
- upstream obsoletes:
krb5-1.12-copy_context.patch
krb5-1.12-enable-NX.patch
krb5-1.12-pic-aes-ni.patch
krb5-master-no-malloc0.patch
krb5-master-ignore-empty-unnecessary-final-token.patch
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=117
- update to version 1.12
* Add GSSAPI extensions for constructing MIC tokens using IOV lists
* Add a FAST OTP preauthentication module for the KDC which uses
RADIUS to validate OTP token values.
* The AES-based encryption types will use AES-NI instructions
when possible for improved performance.
- revert dependency on libcom_err-mini-devel since it's not yet
available
- update and rebase patches
OBS-URL: https://build.opensuse.org/request/show/213903
OBS-URL: https://build.opensuse.org/package/show/network/krb5?expand=0&rev=114
