linux/meta-openembedded.git/meta-oe/recipes-connectivity/krb5/krb5_1.13.2.bb, branch hardknott

krb5: upgrade to 1.13.6

2016-09-15T08:22:49+00:00

* fix CVEs: CVE-2015-8629, CVE-2015-8630, CVE-2015-8631 * update LIC_FILES_CHKSUM, only Copyright changed in NOTICE file: -Copyright (C) 1985-2015 by the Massachusetts Institute of Technology. +Copyright (C) 1985-2016 by the Massachusetts Institute of Technology. * remove useless functions: krb5_do_unpack(), do_unpack() * remove patches that included by new release: - 0001-Work-around-uninitialized-warning-in-cc_kcm.c.patch - Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch - Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch - Fix-build_principal-memory-bug-CVE-2015-2697.patch - Fix-IAKERB-context-export-import-CVE-2015-2698.patch - krb5-CVE-2016-3119.patch - krb5-CVE-2016-3120.patch Signed-off-by: Wenzong Fan Signed-off-by: Martin Jansa

krb5: Fix S4U2Self KDC crash when anon is restricted

2016-09-05T11:30:50+00:00

This is CVE-2016-3120 The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request. Signed-off-by: Alexandru Moise Signed-off-by: Martin Jansa

meta-oe: Standardize use of "_append" versus use of "+="

2016-08-22T13:49:29+00:00

Remove superfluous "+=", then manually add necessary leading space. Signed-off-by: Robert P. J. Day Signed-off-by: Martin Jansa

krb5: add systemd support

2016-06-23T13:21:26+00:00

Signed-off-by: Wenzong Fan Signed-off-by: Martin Jansa

krb5: fix uninitialized variable warning

2016-05-19T10:02:39+00:00

On some targets clang erroniously detects an uninitialized variable. Backport the fix from upstream. Signed-off-by: Daniel McGregor Signed-off-by: Martin Jansa

krb5-CVE-2016-3119.patch

2016-04-28T08:38:40+00:00

Backport from krb5 upstream to fix CVE-2016-3119 avoid remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal. Signed-off-by: Zhixiong Chi Signed-off-by: Martin Jansa

meta-oe: use bb.utils.contains() instead of base_contains()

2016-04-28T08:38:38+00:00

base_contains() is a compatibility wrapper and may warn in the future, so replace all instances with bb.utils.contains(). Signed-off-by: Ross Burton Signed-off-by: Martin Jansa

krb5: add native and nativesdk extend

2016-04-21T19:33:18+00:00

add native and nativesdk extend, curl-native/nativesdk need them. replace the hardcode /etc with ${sysconfdir}, /var with ${localstatedir} Signed-off-by: Roy Li Signed-off-by: Martin Jansa

krb5: Fix build warning

2016-02-25T16:45:43+00:00

WARNING: /tmp/work/armv5e-poky-linux-gnueabi/krb5/1.12.2-r0/krb5-1.12.2/src/ ('S') doesn't exist, please set 'S' to a proper value remove extra "/" Signed-off-by: Armin Kuster Signed-off-by: Martin Jansa

krb5: fix CVE-2015-2698

2015-12-18T11:28:24+00:00

The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696. Backport upstream commit to fix it: https://github.com/krb5/krb5/commit/3db8dfec1ef50ddd78d6ba9503185995876a39fd Signed-off-by: Wenzong Fan Signed-off-by: Martin Jansa