New Debian krb5 1.20.1-2+deb12u4 fixes: This update addresses the following issues: * krb5: Memory leak at /krb5/src/kdc/ndr.c (CVE-2024-26462) * krb5: overflow when calculating ulog block size (CVE-2025-24528) 1.20.1-2+deb12u4 (Wed, 07 May 2025 19:06:22 +0200) * Non Maintainer upload by LTS team * Fix CVE-2025-3576. A Vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering. * Tickets will not be issued with RC4 or triple-DES session keys unless explicitly configured with the new allow_rc4 or allow_des3 variables respectively. * In KDC, assume all services support aes256-sha1 To facilitate negotiating session keys with acceptable security, assume that services support aes256-cts-hmac-sha1 unless a session_enctypes string attribute says otherwise.
--- mirror/ftp/pool/main/k/krb5/krb5_1.20.1-2+deb12u3.dsc +++ apt/ucs_5.2-0-errata5.2-3/source/krb5_1.20.1-2+deb12u4.dsc @@ -1,3 +1,22 @@ +1.20.1-2+deb12u4 [Wed, 07 May 2025 19:06:22 +0200] Bastien Roucariès <rouca@debian.org>: + + * Non Maintainer upload by LTS team + * Fix CVE-2025-3576. Closes: #1103525 + A Vulnerability in the MIT Kerberos implementation + allows GSSAPI-protected messages using RC4-HMAC-MD5 + to be spoofed due to weaknesses in the MD5 checksum design. + If RC4 is preferred over stronger encryption types, + an attacker could exploit MD5 collisions to forge message + integrity codes. This may lead to unauthorized + message tampering. + * Tickets will not be issued with RC4 or triple-DES session + keys unless explicitly configured with the new allow_rc4 + or allow_des3 variables respectively. + * In KDC, assume all services support aes256-sha1 + To facilitate negotiating session keys with acceptable security, + assume that services support aes256-cts-hmac-sha1 unless a + session_enctypes string attribute says otherwise. + 1.20.1-2+deb12u3 [Sun, 23 Feb 2025 17:42:24 +0000] Bastien Roucariès <rouca@debian.org>: * Non Maintainer upload by LTS team <http://piuparts.knut.univention.de/5.2-3/#35699542233531854>
OK: YAML OK: Tests OK: piuparts
<https://errata.software-univention.de/#/?erratum=5.2x195>