aboutsummaryrefslogtreecommitdiffstats
path: root/meta-oe/recipes-connectivity/krb5/krb5
AgeCommit message (Collapse)Author
2018-05-17krb5: support environment setting on systemdHongxu Jia
Let krb5 support environment setting on systemd startup. Here is one requirement of environment setting from upstream krb5 ... https://web.mit.edu/kerberos/krb5-1.16/doc/admin/conf_files/kdc_conf.html |Normally, the kdc.conf file is found in the KDC state directory, LOCALSTATEDIR/krb5kdc. You can override the default location by setting the environment variable KRB5_KDC_PROFILE. ... The fix of (krb5-admin-server.service/krb5-kdc.service) refers ubuntu 1604 Variable RUN_KADMIND is sysvinit, move it out from default/krb5-admin-server Signed-off-by: Hongxu Jia <hongxu.jia@windriver.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-04-08krb5: refresh 0001-aclocal-Add-parameter-to-disable-keyutils-detection.patchAndreas Müller
Signed-off-by: Andreas Müller <schnitzeltony@gmail.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2018-03-12krb5: 1.15.1 -> 1.16Huang Qiyu
1.Upgrade krb5 from 1.15.1 to 1.16 2.Update the checksum of LIC_FILES_CHKSUM, since krb5 has been changed. But lincese remains the same.just modify the following. -Copyright (C) 1985-2016 by the Massachusetts Institute of Technology. +Copyright (C) 1985-2017 by the Massachusetts Institute of Technology. -The KCM Mach RPC definition file used on OS X has the following +The KCM Mach RPC definition file used on macOS has the following Signed-off-by: Huang Qiyu <huangqy.fnst@cn.fujitsu.com> Signed-off-by: Armin Kuster <akuster808@gmail.com>
2017-09-18krb5: CVE-2017-11462Catalin Enache
Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error. Reference: https://nvd.nist.gov/vuln/detail/CVE-2017-11462 Upstream patch: https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf Signed-off-by: Catalin Enache <catalin.enache@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2017-09-07krb5: fix CVE-2017-11368Kai Kang
Backport patch to fix CVE-2017-11368 for krb5. Signed-off-by: Kai Kang <kai.kang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-09-15krb5: upgrade to 1.13.6Wenzong Fan
* fix CVEs: CVE-2015-8629, CVE-2015-8630, CVE-2015-8631 * update LIC_FILES_CHKSUM, only Copyright changed in NOTICE file: -Copyright (C) 1985-2015 by the Massachusetts Institute of Technology. +Copyright (C) 1985-2016 by the Massachusetts Institute of Technology. * remove useless functions: krb5_do_unpack(), do_unpack() * remove patches that included by new release: - 0001-Work-around-uninitialized-warning-in-cc_kcm.c.patch - Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch - Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch - Fix-build_principal-memory-bug-CVE-2015-2697.patch - Fix-IAKERB-context-export-import-CVE-2015-2698.patch - krb5-CVE-2016-3119.patch - krb5-CVE-2016-3120.patch Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-09-05krb5: Fix S4U2Self KDC crash when anon is restrictedAlexandru Moise
This is CVE-2016-3120 The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request. Signed-off-by: Alexandru Moise <alexandru.moise@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-06-23krb5: add systemd supportWenzong Fan
Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-05-19krb5: fix uninitialized variable warningDaniel McGregor
On some targets clang erroniously detects an uninitialized variable. Backport the fix from upstream. Signed-off-by: Daniel McGregor <daniel.mcgregor@vecima.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2016-04-28krb5-CVE-2016-3119.patchZhixiong Chi
Backport <commit 08c642c09c38a9c6454ab43a9b53b2a89b9eef99> from krb5 upstream <https://github.com/krb5/krb5> to fix CVE-2016-3119 avoid remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal. Signed-off-by: Zhixiong Chi <Zhixiong.Chi@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-12-18krb5: fix CVE-2015-2698Wenzong Fan
The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows remote authenticated users to cause a denial of service (memory corruption) or possibly have unspecified other impact by interacting with an application that calls the gss_export_sec_context function. NOTE: this vulnerability exists because of an incorrect fix for CVE-2015-2696. Backport upstream commit to fix it: https://github.com/krb5/krb5/commit/3db8dfec1ef50ddd78d6ba9503185995876a39fd Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-12-18krb5: fix CVE-2015-2697Wenzong Fan
The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request. Backport upstream commit to fix it: https://github.com/krb5/krb5/commit/f0c094a1b745d91ef2f9a4eae2149aac026a5789 Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-12-18krb5: fix CVE-2015-2696Wenzong Fan
lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted IAKERB packet that is mishandled during a gss_inquire_context call. Backport upstream commit to fix it: https://github.com/krb5/krb5/commit/e04f0283516e80d2f93366e0d479d13c9b5c8c2a Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-12-18krb5: fix CVE-2015-2695Wenzong Fan
lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect pointer read and process crash) via a crafted SPNEGO packet that is mishandled during a gss_inquire_context call. Backport upstream commit to fix it: https://github.com/krb5/krb5/commit/b51b33f2bc5d1497ddf5bd107f791c101695000d Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2015-05-17krb5: upgrade to 1.13.2Roy Li
Upgrade to include the CVE fixes: [CVE-2014-5354] [CVE-2014-5353]... Remove the 0001-Return-only-new-keys-in-randkey-CVE-2014-5351.patch Regenerate the /var/run/krb5kdc dir Signed-off-by: Roy Li <rongqing.li@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2014-11-24krb5: fix CVE-2014-5351Wenzong Fan
The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authentic- ated users to forge tickets by leveraging administrative access. This back-ported patch fixes CVE-2014-5351. Signed-off-by: Wenzong Fan <wenzong.fan@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2014-10-04krb5: update to version 1.12.2Jackie Huang
Changed: * Add init scripts and default configs based on debian * Add a patch for crosscompile nm * Add a patch to suppress /usr/lib in krb5-config * Add DESCRIPTION * Remove blacklist and inherit autotools-brokensep * Add PACKAGECONFIG for ldap and readline Signed-off-by: Jackie Huang <jackie.huang@windriver.com> Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
2013-10-05krb5: Add PACKAGECONFIG and new configure param to disable keyutils detectionMartin Jansa
Signed-off-by: Martin Jansa <Martin.Jansa@gmail.com>
generated by cgit 1.2.3-korg (git 2.39.0) at 2024-09-26 12:05:06 +0000