Summary
[1.15.1-18]
- Expose context errors in pkinit_server_plugin_init
- Resolves: #1460089
[1.15.1-17]
- Drop certauth test changes that prevented runnig it
- Resolves: #1498767
[1.15.1-16]
- Drop irrelevant DIR trigger logic
- Resolves: #1431198
[1.15.1-15]
- Fix CVE-2017-7562 (certauth eku bypass)
- Resolves: #1498767
[1.15.1-14]
- Fix CVE-2017-11368 (s4u2 request assertion failures)
- Resolves: #1498768
[1.15.1-13]
- Force-add /etc/krb5.conf.d so we can guarantee it exists
- Resolves: #1431198
[1.15.1-12]
- Add krb5 policy plugin interface
- Remove soname downgrade
- Resolves: #1462982
[1.15.1-11]
- Make t_certauth.py runnable
- Resolves: #1443388
[1.15.1-10]
- Add context SSF query support
- Resolves: #1472956
[1.15.1-9]
- Remove incomplete PKINIT OCSP support
- Resolves: #1460089
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | krb5-devel | 0:1.15.1-18.el7 |
| Oracle Linux · 7 | krb5-libs | 0:1.15.1-18.el7 |
| Oracle Linux · 7 | krb5-pkinit | 0:1.15.1-18.el7 |
| Oracle Linux · 7 | krb5-server | 0:1.15.1-18.el7 |
| Oracle Linux · 7 | krb5-server-ldap | 0:1.15.1-18.el7 |
| Oracle Linux · 7 | krb5-workstation | 0:1.15.1-18.el7 |
| Oracle Linux · 7 | libkadm5 | 0:1.15.1-18.el7 |
Vulnerabilities 2
-
Medium 6.5
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of cl…
-
Unscored —
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending inva…