linux/meta-openembedded.git/meta-oe/recipes-connectivity/krb5, branch kirkstone

krb5: fix for CVE-2024-3596

2025-12-25T09:17:01+00:00

Upstream-Status: Backport from https://github.com/krb5/krb5/commit/871125fea8ce0370a972bf65f7d1de63f619b06c Signed-off-by: Hitendra Prajapati Signed-off-by: Gyorgy Sarvari

krb5: fix packaging with ldap PACKAGECONFIG

2025-09-26T11:17:09+00:00

In case ldap PACKAGECONFIG is enabled, packaging fails with the following error: ERROR: krb5-1.17.2-r0 do_package: QA Issue: krb5: Files/directories were installed but not shipped in any package: /usr/lib/libkdb_ldap.so.1.0 /usr/lib/libkdb_ldap.so.1 Fix it by adding the file to the krb5-kdc-ldap package (the same that Debian also uses to ship this file). Signed-off-by: Gyorgy Sarvari

krb5: fix CVE-2025-24528

2025-09-26T11:17:09+00:00

In MIT krb5 release 1.7 and later with incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file, likely causing a process crash. https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0 Reference: https://security-tracker.debian.org/tracker/CVE-2025-24528 Upstream-patch: https://github.com/krb5/krb5/commit/78ceba024b64d49612375be4a12d1c066b0bfbd0 Signed-off-by: Divya Chellam Signed-off-by: Gyorgy Sarvari

krb5: fix CVE-2025-3576

2025-09-06T14:27:24+00:00

Upstream-Status: Backport from https://github.com/krb5/krb5/commit/39fecf78796bbdde1e3d4828b86f64f05d9e4c77 && https://github.com/krb5/krb5/commit/1b57a4d134bbd0e7c52d5885a92eccc815726463 && https://github.com/krb5/krb5/commit/484a6e7712f9b66e782b2520f07b0883889e116f Signed-off-by: Hitendra Prajapati Signed-off-by: Gyorgy Sarvari

krb5: fix CVE-2024-26458 and CVE-2024-26461

2024-08-25T22:11:29+00:00

Upstream-Status: Backport from https://github.com/krb5/krb5/commit/c5f9c816107f70139de11b38aa02db2f1774ee0d Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster

krb5: Fix for CVE-2024-37370 and CVE-2024-37371

2024-07-18T00:06:58+00:00

Upstream-Status: Backport [https://github.com/krb5/krb5/commit/548da160b52b25a106e9f6077d6a42c2c049586c & https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef] Signed-off-by: Vijay Anusuri Signed-off-by: Armin Kuster

krb5: Fix CVE-2023-36054

2023-09-04T15:57:41+00:00

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count. References: https://nvd.nist.gov/vuln/detail/CVE-2023-36054 Signed-off-by: Soumya Sambu Signed-off-by: Armin Kuster

krb5: CVE-2022-42898 integer overflow vulnerabilities in PAC parsing

2023-01-25T13:36:44+00:00

Upstream-Status: Backport from https://github.com/krb5/krb5/commit/4e661f0085ec5f969c76c0896a34322c6c432de4 Signed-off-by: Hitendra Prajapati Signed-off-by: Armin Kuster

krb5: fix CVE-2021-37750

2021-09-10T13:57:43+00:00

CVE-2021-37750: The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field. References: https://nvd.nist.gov/vuln/detail/CVE-2021-37750 Patches from: https://github.com/krb5/krb5/commit/d775c95af7606a51bf79547a94fa52ddd1cb7f49 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj

krb5: fix CVE-2021-36222

2021-09-07T17:03:50+00:00

CVE-2021-36222: ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation. References: https://nvd.nist.gov/vuln/detail/CVE-2021-36222 Patches from: https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562 Signed-off-by: Yi Zhao Signed-off-by: Khem Raj