Summary
[1.21.1-8.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]
[1.21.1-9]
- Do not block HMAC-MD4/5 in FIPS mode
Resolves: RHEL-88704
- Don't issue RC4 session keys by default (CVE-2025-3576)
Resolves: RHEL-88048
- Add PKINIT paChecksum2 from MS-PKCA v20230920
Resolves: RHEL-82647
[1.21.1-7]
- Add dedicated tests sub-package
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | krb5-devel | 0:1.21.1-8.0.1.el9_6 |
| Oracle Linux · 9 | krb5-libs | 0:1.21.1-8.0.1.el9_6 |
| Oracle Linux · 9 | krb5-pkinit | 0:1.21.1-8.0.1.el9_6 |
| Oracle Linux · 9 | krb5-server | 0:1.21.1-8.0.1.el9_6 |
| Oracle Linux · 9 | krb5-server-ldap | 0:1.21.1-8.0.1.el9_6 |
| Oracle Linux · 9 | krb5-workstation | 0:1.21.1-8.0.1.el9_6 |
| Oracle Linux · 9 | libkadm5 | 0:1.21.1-8.0.1.el9_6 |
Vulnerabilities 1
-
Medium 5.9
Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to …