[ol7_latest_archive] krb5-server-1.12.2-14.el7.x86_64

Kerberos is a network authentication system. The krb5-server package
contains the programs that must be installed on a Kerberos 5 key
distribution center (KDC).  If you are installing a Kerberos 5 KDC,
you need to install this package (in other words, most people should
NOT install this package).

Changelog (Show File list) (Show related packages)

• Mon Jan 26 2015 Roland Mainz <rmainz@redhat.com> - 1.12.2-14

  - fix for kinit -C loops (#1184629, MIT/krb5 issue 243, "Do not
    loop on principal unknown errors").

• Mon Jan 12 2015 Roland Mainz <rmainz@redhat.com> - 1.12.2-13

  - fix for CVE-2014-5352 (#1179856) "gss_process_context_token()
    incorrectly frees context (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9421 (#1179857) "kadmind doubly frees partial
    deserialization results (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9422 (#1179861) "kadmind incorrectly
    validates server principal name (MITKRB5-SA-2015-001)"
  - fix for CVE-2014-9423 (#1179863) "libgssrpc server applications
    leak uninitialized bytes (MITKRB5-SA-2015-001)"

• Mon Dec 22 2014 Roland Mainz <rmainz@redhat.com> - 1.12.2-12

  - fix for CVE-2014-5354 (#1174546) "krb5: NULL pointer
    dereference when using keyless entries"

• Mon Dec 22 2014 Roland Mainz <rmainz@redhat.com> - 1.12.2-11

  - fix for CVE-2014-5353 (#1174543) "Fix LDAP misused policy
    name crash"

• Sun Dec 07 2014 Roland Mainz <rmainz@redhat.com> - 1.12.2-10

  - In ksu, without the -e flag, also check .k5users (#1105489)
    When ksu was explicitly told to spawn a shell, a line in .k5users which
    listed "*" as the allowed command would cause the principal named on the
    line to be considered as a candidate for authentication.
    When ksu was not passed a command to run, which implicitly meant that
    the invoking user wanted to run the target user's login shell, knowledge
    that the principal was a valid candidate was ignored, which could cause
    a less optimal choice of the default target principal.
    This doesn't impact the authorization checks which we perform later.
    Patch by Nalin Dahyabhai <nalin@redhat.com>

• Wed Dec 03 2014 Roland Mainz <rmainz@redhat.com> - 1.12.2-9

  - Undo libkadmclnt SONAME change (from 8 to 9) which originally
    happened in the krb5 1.12 rebase (#1166012) but broke
    rubygem-rkerberos (sort of ruby language bindings for
    libkadmclnt&co.) dependicies, as side effect of
    rubygem-rkerberos using private interfaces in libkadmclnt.

• Mon Sep 08 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-8

  - fix the problem where the %license file has been a dangling symlink
  - ksu: pull in fix from pull #206 to avoid breakage when the
    default_ccache_name doesn't include a cache type as a prefix
  - ksu: pull in a proposed fix for pull #207 to avoid breakage when the
    invoking user doesn't already have a ccache

• Sat Sep 06 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-7

  - pull in patch from master to load plugins with RTLD_NODELETE, when
    defined (RT#7947)

• Fri Sep 05 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-6

  - backport patch to make the client skip checking the server's reply
    address when processing responses to password-change requests, which
    between NAT and upcoming HTTPS support, can cause us to erroneously
    report an error to the user when the server actually reported success
    (RT#7886)
  - backport support for accessing KDCs and kpasswd services via HTTPS
    proxies (marked by being specified as https URIs instead as hostnames
    or hostname-and-port), such as the one implemented in python-kdcproxy
    (RT#7929, #109919), and pick up a subsequent patch to build HTTPS
    as a plugin

• Thu Aug 28 2014 Nalin Dahyabhai <nalin@redhat.com> - 1.12.2-5

  - backport fix for trying all compatible keys when not being strict about
    acceptor names while reading AP-REQs (RT#7883, #1078888)
  - define _GNU_SOURCE in files where we use EAI_NODATA, to make sure that
    it's declared (#1059730,#1084068,#1109102)