summaryrefslogtreecommitdiff
path: root/security/mit-krb5
AgeCommit message (Collapse)AuthorFilesLines
2018-12-21mit-krb5: updated to 1.16.2adam10-39/+32
Major changes in 1.16.2 This is a bug fix release. Fix bugs with concurrent use of MEMORY ccache handles. Fix a KDC crash when falling back between multiple OTP tokens configured for a principal entry. Fix memory bugs when gss_add_cred() is used to create a new credential, and fix a bug where it ignores the desired_name. Fix the behavior of gss_inquire_cred_by_mech() when the credential does not contain an element of the requested mechanism. Make cross-realm S4U2Self requests work on the client when no default_realm is configured. Add a kerberos(7) man page containing documentation of the environment variables that affect Kerberos programs.
2018-08-22Recursive bump for perl5-5.28.0wiz1-2/+2
2018-07-16mit-krb5: mmap -Werror=incompatible-pointer-types fixes.jperkin3-1/+45
2018-06-22The SunOS (OmniOS) yacc(1) breaks the build withhauke1-2/+8
making generate-files-mac in kadmin... making generate-files-mac in kadmin/cli... ../../util/ss/mk_cmds kadmin_ct.ct /usr/bin/yacc getdate.y "getdate.y", line 180: fatal: invalid escape, or illegal reserved word: expect *** Error code 1 -- use bison(1) instead.
2018-06-15mit-krb5: update to 1.16.1tez35-153/+142
Major changes in 1.16.1 (2018-05-03) This is a bug fix release. Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. Fix a KDC PKINIT memory leak. Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. Fix a regression in pkinit_cert_match matching of client certificates containing Microsoft UPN SANs. Fix a null dereference when the KDC sends a large TGS reply. Fix "kdestroy -A" with the KCM credential cache type. Allow validation of Microsoft PACs containing enterprise names. Fix the handling of capaths "." values. Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). Major changes in 1.16 (2017-12-05) Administrator experience: The KDC can match PKINIT client certificates against the "pkinit_cert_match" string attribute on the client principal entry, using the same syntax as the existing "pkinit_cert_match" profile option. The ktutil addent command supports the "-k 0" option to ignore the key version, and the "-s" option to use a non-default salt string. kpropd supports a --pid-file option to write a pid file at startup, when it is run in standalone mode. The "encrypted_challenge_indicator" realm option can be used to attach an authentication indicator to tickets obtained using FAST encrypted challenge pre-authentication. Localization support can be disabled at build time with the --disable-nls configure option. Developer experience: The kdcpolicy pluggable interface allows modules control whether tickets are issued by the KDC. The kadm5_auth pluggable interface allows modules to control whether kadmind grants access to a kadmin request. The certauth pluggable interface allows modules to control which PKINIT client certificates can authenticate to which client principals. KDB modules can use the client and KDC interface IP addresses to determine whether to allow an AS request. GSS applications can query the bit strength of a krb5 GSS context using the GSS_C_SEC_CONTEXT_SASL_SSF OID with gss_inquire_sec_context_by_oid(). GSS applications can query the impersonator name of a krb5 GSS credential using the GSS_KRB5_GET_CRED_IMPERSONATOR OID with gss_inquire_cred_by_oid(). kdcpreauth modules can query the KDC for the canonicalized requested client principal name, or match a principal name against the requested client principal name with canonicalization. Protocol evolution: The client library will continue to try pre-authentication mechanisms after most failure conditions. The KDC will issue trivially renewable tickets (where the renewable lifetime is equal to or less than the ticket lifetime) if requested by the client, to be friendlier to scripts. The client library will use a random nonce for TGS requests instead of the current system time. For the RC4 string-to-key or PAC operations, UTF-16 is supported (previously only UCS-2 was supported). When matching PKINIT client certificates, UPN SANs will be matched correctly as UPNs, with canonicalization. User experience: Dates after the year 2038 are accepted (provided that the platform time facilities support them), through the year 2106. Automatic credential cache selection based on the client realm will take into account the fallback realm and the service hostname. Referral and alternate cross-realm TGTs will not be cached, avoiding some scenarios where they can be added to the credential cache multiple times. A German translation has been added. Code quality: The build is warning-clean under clang with the configured warning options. The automated test suite runs cleanly under AddressSanitizer. Major changes in 1.15.3 (2018-05-03) This is a bug fix release. Fix flaws in LDAP DN checking, including a null dereference KDC crash which could be triggered by kadmin clients with administrative privileges [CVE-2018-5729, CVE-2018-5730]. Fix a KDC PKINIT memory leak. Fix a small KDC memory leak on transited or authdata errors when processing TGS requests. Fix a null dereference when the KDC sends a large TGS reply. Fix "kdestroy -A" with the KCM credential cache type. Fix the handling of capaths "." values. Fix handling of repeated subsection specifications in profile files (such as when multiple included files specify relations in the same subsection). Major changes in 1.15.2 (2017-09-25) This is a bug fix release. Fix a KDC denial of service vulnerability caused by unset status strings [CVE-2017-11368] Preserve GSS contexts on init/accept failure [CVE-2017-11462] Fix kadm5 setkey operation with LDAP KDB module Use a ten-second timeout after successful connection for HTTPS KDC requests, as we do for TCP requests Fix client null dereference when KDC offers encrypted challenge without FAST Ignore dotfiles when processing profile includedir directive Improve documentation Major changes in 1.15.1 (2017-03-01) This is a bug fix release. Allow KDB modules to determine how the e_data field of principal fields is freed Fix udp_preference_limit when the KDC location is configured with SRV records Fix KDC and kadmind startup on some IPv4-only systems Fix the processing of PKINIT certificate matching rules which have two components and no explicit relation Improve documentation Major changes in 1.15 (2016-12-01) Administrator experience: Improve support for multihomed Kerberos servers by adding options for specifying restricted listening addresses for the KDC and kadmind. Add support to kadmin for remote extraction of current keys without changing them (requires a special kadmin permission that is excluded from the wildcard permission), with the exception of highly protected keys. Add a lockdown_keys principal attribute to prevent retrieval of the principal's keys (old or new) via the kadmin protocol. In newly created databases, this attribute is set on the krbtgt and kadmin principals. Restore recursive dump capability for DB2 back end, so sites can more easily recover from database corruption resulting from power failure events. Add DNS auto-discovery of KDC and kpasswd servers from URI records, in addition to SRV records. URI records can convey TCP and UDP servers and master KDC status in a single DNS lookup, and can also point to HTTPS proxy servers. Add support for password history to the LDAP back end. Add support for principal renaming to the LDAP back end. Use the getrandom system call on supported Linux kernels to avoid blocking problems when getting entropy from the operating system. In the PKINIT client, use the correct DigestInfo encoding for PKCS #1 signatures, so that some especially strict smart cards will work. Code quality: Clean up numerous compilation warnings. Remove various infrequently built modules, including some preauth modules that were not built by default. Developer experience: Add support for building with OpenSSL 1.1. Use SHA-256 instead of MD5 for (non-cryptographic) hashing of authenticators in the replay cache. This helps sites that must build with FIPS 140 conformant libraries that lack MD5. Eliminate util/reconf and allow the use of autoreconf alone to regenerate the configure script. Protocol evolution: Add support for the AES-SHA2 enctypes, which allows sites to conform to Suite B crypto requirements.
2018-05-25mit-krb5: Avoid bogus -Wuninitialized warning.jperkin2-1/+17
2017-10-10mit-krb5: update to 1.14.6tez3-87/+7
Major changes in 1.14.6 (2017-09-25) This is a bug fix release. Fix a KDC denial of service vulnerability caused by unset status strings [CVE-2017-11368] Preserve GSS contexts on init/accept failure [CVE-2017-11462] Fix kadm5 setkey operation with LDAP KDB module Use a ten-second timeout after successful connection for HTTPS KDC requests, as we do for TCP requests Fix client null dereference when KDC offers encrypted challenge without FAST
2017-08-21Update to 1.14.5 and patch for CVE-2017-11368tez3-7/+88
2016-10-31Need to take advantage of the logic that makes this null on non-OSX.tez1-2/+2
(distinfo already has the checksum for this corrected patch, sorry.)
2016-10-28Update to 1.14.4 and fix build on OS Xtez4-8/+40
Should resolve PR#51136
2016-07-09Bump PKGREVISION for perl-5.24.0 for everything mentioning perl.wiz1-2/+2
2016-06-21Make sure that LDFLAGS are not ignored. Fixes build on at least SunOS.fhajny2-4/+5
2016-05-17Use REAL_ROOT_USER/REAL_ROOT_GROUP instead of ROOT_USER/ROOT_GROUPfhajny1-3/+3
for all pkgsrc dir/file ownership rules. Fixes unprivileged user/group names from leaking into binary packages, manifest as non-fatal chown/chgrp failure messages at pkg_add time. Bump respective packages' PKGREVISION.
2016-04-17Fix build on recent NetBSD-currentkamil3-6/+17
The RTM_RESOLVE symbol has been removed after the following change in src/sys/net/route.h: revision 1.98 date: 2016-04-04 09:37:07 +0200; author: ozaki-r; state: Exp; lines: +8 -6; commitid: r0chxU5ZkTdAqh1z; Separate nexthop caches from the routing table Bump PKGREVISION to 1
2016-03-18Fix build on 64 bit intel systems with yasm installed.tez1-1/+2
2016-03-15Missed one checksum update... fixed.tez1-2/+2
2016-03-15Update to 1.14.1 resolving all reported vulnerabilities including:tez34-790/+241
CVE-2015-2695 CVE-2015-2696 CVE-2015-2697 CVE-2015-2698 CVE-2015-8629 CVE-2015-8630 CVE-2015-8631
2016-03-10Ensure libss is built -static, the library is not installed resultingjperkin3-7/+10
in runtime failures which weren't previously detected due to a bug in check-shlibs. Bump PKGREVISION.
2016-03-05Bump PKGREVISION for security/openssl ABI bump.jperkin1-2/+2
2015-11-05Fix build in case there is a system version of verto found.tez1-1/+2
No revbump because it failed to build before if there was one. Fixes pkg/50348
2015-11-04Add /usr/lib/mit/bin/krb5-config as a possible location for thejperkin1-1/+2
krb5-config script, fixing SLES according to sobukus on IRC.
2015-11-04Add SHA512 digests for distfiles for security categoryagc1-1/+3
Problems found locating distfiles: Package f-prot-antivirus6-fs-bin: missing distfile fp-NetBSD.x86.32-fs-6.2.3.tar.gz Package f-prot-antivirus6-ws-bin: missing distfile fp-NetBSD.x86.32-ws-6.2.3.tar.gz Package libidea: missing distfile libidea-0.8.2b.tar.gz Package openssh: missing distfile openssh-7.1p1-hpn-20150822.diff.bz2 Package uvscan: missing distfile vlp4510e.tar.Z Otherwise, existing SHA1 digests verified and found to be the same on the machine holding the existing distfiles (morden). All existing SHA1 digests retained for now as an audit trail.
2015-06-12Recursive PKGREVISION bump for all packages mentioning 'perl',wiz1-2/+2
having a PKGNAME of p5-*, or depending such a package, for perl-5.22.0.
2015-05-26Ensure we can find OpenSSL after rpath changes.jperkin3-2/+19
2015-03-22Redo rpath handling as the option is leaked into the config binary.joerg5-11/+26
Bump revision.
2015-03-16GC MAKE_PROGRAM as well.joerg1-2/+1
2015-03-15Don't use -R without argument. Make libapputils a convenience archive asjoerg4-35/+135
it is. Don't depend on gmake.
2015-03-12post-extract target needs gzip as tooltnn1-2/+2
2015-02-25Backported fixes for:tez5-3/+400
http://web.mit.edu/kerberos/advisories/2015-001-patch-r111.txt http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5352 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9421 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9422 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9423 and: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5353 and http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5355 (also apparently known as SA62976)
2014-11-25Add patch for CVE-2014-5351 from:tez3-3/+55
http://krbdev.mit.edu/rt/Ticket/Display.html?id=8018 https://github.com/krb5/krb5/commit/3bf9e33f9d66c0eef486cbd83f9e4f13a74d12c3.diff
2014-08-28Add fixes for CVE-2014-4341, CVE-2014-4342 (same patch as CVE-2014-4341)tez5-5/+159
CVE-2014-4343, CVE-2014-4344 & MITKRB5-SA-2014-001 (CVE-2014-4345).
2014-05-29Bump for perl-5.20.0.wiz1-2/+2
Do it for all packages that * mention perl, or * have a directory name starting with p5-*, or * depend on a package starting with p5- like last time, for 5.18, where this didn't lead to complaints. Let me know if you have any this time.
2014-03-11Remove example rc.d scripts from PLISTs.jperkin1-3/+1
These are now handled dynamically if INIT_SYSTEM is set to "rc.d", or ignored otherwise.
2014-02-28Also define KRB5_CONFIG for the case not using builtin mit-krb5.obache1-1/+5
2014-02-13Fix for Darwin version higher that 10adam1-2/+2
2014-02-12Recursive PKGREVISION bump for OpenSSL API version bump.tron1-1/+2
2013-12-11On SunOS, install a wrapper script for krb5-config to strip away argumentsjperkin2-1/+41
that are unsupported by the native port of MIT KRB5, and add any flags necessary to support the builtin version. Fixes various packages since the change to support the SunOS builtin. Based on patches by Richard PALO (richard@).
2013-12-03Changes 1.10.7:adam2-6/+6
This is a bugfix release. The krb5-1.10 release series is in maintenance, and for new deployments, installers should prefer the krb5-1.11 release series or later. * Fix a KDC locking issue that could lead to the KDC process holding a persistent lock, preventing administrative actions such as password changes. * Fix a number of bugs related to KDC master key rollover. * Fix a KDC null pointer dereference [CVE-2013-1418] that could affect KDCs that serve multiple realms.
2013-11-23Use find-headers instead of find-files to detect builtin header files.obache1-5/+6
2013-10-26update mit-krb5 builtin for solaris and better krb5-config supportrichard2-4/+23
2013-10-20Pass rpath options with correct -Wl prefix.joerg2-5/+66
2013-10-12revert API to 1.4nb1 for mit-krb5 builtin supportrichard1-3/+2
2013-08-30Don't use IP_PKTINFO on NetBSD, it doesn't support all required fields.joerg2-1/+15
2013-06-16Changes 1.10.6:adam3-61/+6
Fix a UDP ping-pong vulnerability in the kpasswd (password changing) service. [CVE-2002-2443] Improve interoperability with some Windows native PKINIT clients.
2013-05-31Bump all packages for perl-5.18, thatwiz1-2/+2
a) refer 'perl' in their Makefile, or b) have a directory name of p5-*, or c) have any dependency on any p5-* package Like last time, where this caused no complaints.
2013-05-13The kpasswd service provided by kadmind was vulnerable to a UDPtez3-2/+57
"ping-pong" attack [CVE-2002-2443]. Don't respond to packets unless they pass some basic validation, and don't respond to our own error packets. Some authors use CVE-1999-0103 to refer to the kpasswd UDP ping-pong attack or UDP ping-pong attacks in general, but there is discussion leading toward narrowing the definition of CVE-1999-0103 to the echo, chargen, or other similar built-in inetd services. https://github.com/krb5/krb5/commit/cf1a0c411b2668c57c41e9c4efd15ba17b6b322ccvs
2013-05-09Changes 1.10.5:adam3-35/+6
This is a bugfix release. The krb5-1.10 release series is in maintenance, and for new deployments, installers should prefer the krb5-1.11 release series or later. * Fix KDC null pointer dereference in TGS-REQ handling [CVE-2013-1416] * Incremental propagation could erroneously act as if a slave's database were current after the slave received a full dump that failed to load.
2013-04-23Fix for CVE-2013-1416 from:tez3-2/+31
http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7600
2013-03-14Fix build on Solaristez1-1/+2
(per http://old.nabble.com/Re%3A-build-problem-p34365918.html)
2013-03-13Changes 1.10.4:adam6-244/+10
This is a bugfix release. Fix null PKINIT pointer dereference vulnerabilities [CVE-2012-1016, CVE-2013-1415] Prevent the KDC from returning a host-based service principal referral to the local realm.
generated by cgit v1.2.3 (git 2.39.1) at 2025-04-10 09:29:48 +0000