Summary
It was discovered that Kerberos allowed the usage of weak cryptographic
standards. An attacker could possibly use this issue to expose sensitive
information.
This update introduces the allow_rc4 and allow_des3 configuration options,
and disables the usage of RC4 and 3DES ciphers by default. Users are
advised to discontinue their usage and upgrade to stronger encryption
protocols. If the use of the insecure RC4 and 3DES algorithms is necessary,
they can be enabled with the aforementioned configuration options.
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | krb5 | 1.17-6ubuntu4.11 |
| Ubuntu · 22.04 LTS 22.04:LTS | krb5 | 1.19.2-2ubuntu0.7 |
| Ubuntu · 24.04 LTS 24.04:LTS | krb5 | 1.20.1-6ubuntu2.6 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | krb5 | 1.12+dfsg-2ubuntu5.4+esm7 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | krb5 | 1.13.2+dfsg-5ubuntu2.2+esm7 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | krb5 | 1.16-2ubuntu0.4+esm5 |
Vulnerabilities 1
-
Medium 5.9
Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions
A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to …
References
-
report
https://ubuntu.com/security/CVE-2025-3576