Summary
[1.21.1-4.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]
[1.21.1-4]
- libkrad: implement support for Message-Authenticator (CVE-2024-3596)
Resolves: RHEL-55423
- Fix various issues detected by static analysis
Resolves: RHEL-58216
- Remove RSA protocol for PKINIT
Resolves: RHEL-15323
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | krb5-devel | 0:1.21.1-4.0.1.el9_5 |
| Oracle Linux · 9 | krb5-libs | 0:1.21.1-4.0.1.el9_5 |
| Oracle Linux · 9 | krb5-pkinit | 0:1.21.1-4.0.1.el9_5 |
| Oracle Linux · 9 | krb5-server | 0:1.21.1-4.0.1.el9_5 |
| Oracle Linux · 9 | krb5-server-ldap | 0:1.21.1-4.0.1.el9_5 |
| Oracle Linux · 9 | krb5-workstation | 0:1.21.1-4.0.1.el9_5 |
| Oracle Linux · 9 | libkadm5 | 0:1.21.1-4.0.1.el9_5 |
Vulnerabilities 1
-
Critical 9.0
RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.
RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…