Moderate: krb5 security update (Oracle Linux 7)

[1.15.1-55.0.3]
- Length check when parsing GSS token encapsulation [Orabug: 36927256]
- Add a simple DER support header [Orabug: 36927256]
- Fix vulnerabilities in GSS message token handling [Orabug: 36927256]

[1.15.1-55.0.1]
- Add recursion limit for ASN.1 indefinite lengths [Orabug: 32582360]

[1.15.1-55]
- Fix integer overflows in PAC parsing (CVE-2022-42898)
- Resolves: rhbz#2140961

[1.15.1-54]
- Try harder to avoid password change replay errors
- Resolves: #2063163

[1.15.1-53]
- Backport usage of SHA-256 instead of SHA-1 for PKINIT CMS digest
- Resolves: #2066319

[1.15.1-51]
- Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
- Resolves: #1997599

[1.15.1-50]
- Disable smoke tests on s390x and remove sleep
- Resolves: #1782492

[1.15.1-49]
- Fix LDAP policy enforcement of pw_expiration
- Resolves: #1782492

[1.15.1-48]
- Fix LDAP policy enforcement of pw_expiration
- Resolves: #1782492

[1.15.1-47]
- Do expiration warnings for all init_creds APIs
- Resolves: #1733289

[1.15.1-46]
- Add pkinit_cert_match support
- Resolves: #1656126

[1.15.1-45]
- Install kerberos(7)
- Resolves: #1704726

[1.15.1-44]
- Address some optimized-out memset() calls
- Resolves: #1663506

[1.15.1-43]
- Correct kpasswd_server description in krb5.conf(5)
- Resolves: #1498347

[1.15.1-42]
- Log when non-root ksu authorization fails
- Resolves: #1270927

[1.15.1-41]
- Update man pages to reference kerberos(7)
- Resolves: #1704726

[1.15.1-40]
- Prefer TCP to UDP for password changes
- Resolves: #1637349

[1.15.1-39]
- Remove incorrect KDC assertion
- Resolves: #1673017

[1.15.1-38]
- Add FILE prefix to pkinit_anchors field
- Resolves: #1661338

[1.15.1-37]
- Bring back builtin crypto (openssl broke too many FIPS setups)
- Resolves: #1645711

[1.15.1-36]
- Clean up MEMORY ccache behavior to match upstream more closely
- Resolves: #1605756

[1.15.1-35]
- Fix bugs with concurrent use of MEMORY ccaches
- Resolves: #1605756

[1.15.1-34]
- In FIPS mode, add plaintext fallback for RC4 usages and taint
- Resolves: #1570600

[1.15.1-33]
- Use SHA-256 instead of MD5 for audit ticket IDs
- Resolves: #1570600

[1.15.1-32]
- Include preauth name in trace output if possible
- Update cert generation scripts to work on modern openssl
- Fix per-request preauth scoping
- Add test case for PKINIT DH renegotiation
- Echo KDC cookies in preauth tryagain
- Fall back to other preauth mechanisms after failures
- Resolves: #1540130

[1.15.1-31]
- Add German translation
- Resolves: #1497301

[1.15.1-30]
- Add default pkinit_anchors value to krb5.conf
- Resolves: #1508081

[1.15.1-29]
- Process profile includedir in sorted order
- Also, ignore dotfiles in included directories
- Resolves: #1539824

[1.15.1-28]
- Exit with status 0 from kadmind
- Resolves: #1373909

[1.15.1-27]
- Continue after KRB5_CC_END in KCM cache iteration
- Resolves: #1563166

[1.15.1-26]
- Merge duplicate subsections in profile library
- Resolves: #1519625

[1.15.1-25]
- Fix service dependencies on network state
- Resolves: #1525232

[1.15.1-24]
- Explicitly use openssl rather than builtin crypto
- Resolves: #1570600

[1.15.1-23]
- Fix flaws in LDAP DN checking (CVE-2018-5729, CVE-2018-5730)
- Resolves: #1562684
- Resolves: #1562679

[1.15.1-22]
- Fix segfault in finish_dispatch()
- Resolves: #1568970

[1.15.1-21]
- Unparse SANs with NO_REALM
- Resolves: #1482457

[1.15.1-20]
- Fix hex conversion of PKINIT certid strings
- Resolves: #1538491

[1.15.1-19]
- Limit ticket lifetime to 2^31-1 seconds
- Resolves: #1554723

[1.15.1-18]
- Expose context errors in pkinit_server_plugin_init
- Resolves: #1460089

[1.15.1-17]
- Drop certauth test changes that prevented runnig it
- Resolves: #1498767

[1.15.1-16]
- Drop irrelevant DIR trigger logic
- Resolves: #1431198

[1.15.1-15]
- Fix CVE-2017-7562 (certauth eku bypass)
- Resolves: #1498767

[1.15.1-14]
- Fix CVE-2017-11368 (s4u2 request assertion failures)
- Resolves: #1498768

[1.15.1-13]
- Force-add /etc/krb5.conf.d so we can guarantee it exists
- Resolves: #1431198

[1.15.1-12]
- Add krb5 policy plugin interface
- Remove soname downgrade
- Resolves: #1462982

[1.15.1-11]
- Make t_certauth.py runnable
- Resolves: #1443388

[1.15.1-10]
- Add context SSF query support
- Resolves: #1472956

[1.15.1-9]
- Remove incomplete PKINIT OCSP support
- Resolves: #1460089

[1.15.1-8]
- Add kprop.service argument file
- Resolves: #1389073

[1.15.1-7]
- Fix enterprise principal forwarding
- Resolves: #1378440

[1.15.1-6]
- Fix bug in certauth backport
- Resolves: #1428484

[1.15.1-5]
- rubygem-rkerberos still needs us to lie about soname
- Resolves: #1389073

[1.15.1-4]
- Backport certauth plugin and related pkinit changes
- Note: related changes cannot be tested because RHEL does not allow
binary git diffs
- Resolves: #1428484

[1.15.1-3]
- Remove duplication between subpackages
- Resolves: #1254640

[1.15.1-2]
- Add back deleted sources
- Resolves: #1389073

[1.15.1-1]
- Bump to krb5-1.15.1 (very small change)
- Apply some sanity to our patches and ordering
- Resolves: #1389073

[1.15-2]
- Reinstate e_data free method; bumps KDB to 6.1
- Resolves: #1389073

[1.15-1]
- Rebase to 1.15-final
- Resolves: #1389073
- Resolves: #1367169
- Resolves: #1389072
- Resolves: #1366863

[1.14.1-27]
- Properly handle EOF on libkrad sockets
- Resolves: #1382449

[1.14.1-26]
- Use responder in non-preauth AS reqs
- Resolves: #1363690

[1.14.1-25]
- Fix bad debug_log() call in selinux handling
- Resolves: #1292153

[1.14.1-24]
- Fix KKDCPP with TLS SNI by always presenting 'Host:' header
- Resolves: #1364993

[1.14.1-23]
- Add dependency on libkadm5 to krb5-devel
- Resolves: #1347403

[1.14.1-22]
- Builders have new version of mock; adapt.
- Resolves: #1290239

[1.14.1-21]
- Fix CVE-2016-3120
- Resolves: #1361504

[1.14.1-20]
- Make version dependencies on libkadm5 more explicit to appease rpmdiff
- Resolves: #1347403

[1.14.1-19]
- Add in upstream version of kprop port and tests
- Resolves: #1292795

[1.14.1-18]
- Fix incorrect rec