Summary
[1.18.2-34.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]
[1.18.2-34]
- Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
Resolves: RHEL-171589 RHEL-171594
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | krb5-devel | 0:1.18.2-34.0.1.el8_10 |
| Oracle Linux · 8 | krb5-libs | 0:1.18.2-34.0.1.el8_10 |
| Oracle Linux · 8 | krb5-pkinit | 0:1.18.2-34.0.1.el8_10 |
| Oracle Linux · 8 | krb5-server | 0:1.18.2-34.0.1.el8_10 |
| Oracle Linux · 8 | krb5-server-ldap | 0:1.18.2-34.0.1.el8_10 |
| Oracle Linux · 8 | krb5-workstation | 0:1.18.2-34.0.1.el8_10 |
| Oracle Linux · 8 | libkadm5 | 0:1.18.2-34.0.1.el8_10 |
Vulnerabilities 2
-
Medium 5.9
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_…
-
Medium 5.9
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an applic…