krb5 commit [krb5-1.12]: Updates for krb5-1.12.5
Tom Yu
tlyu at mit.edu
Wed Dec 16 15:34:31 EST 2015
https://github.com/krb5/krb5/commit/a15935b91639a4c97b256c2575de83d68b807137
commit a15935b91639a4c97b256c2575de83d68b807137
Author: Tom Yu <tlyu at mit.edu>
Date: Mon Dec 14 16:23:34 2015 -0500
Updates for krb5-1.12.5
README | 53 ++++++++++++++++++++++++++++++++++++++++++++
src/man/k5identity.man | 2 +-
src/man/k5login.man | 2 +-
src/man/k5srvutil.man | 2 +-
src/man/kadm5.acl.man | 2 +-
src/man/kadmin.man | 2 +-
src/man/kadmind.man | 2 +-
src/man/kdb5_ldap_util.man | 2 +-
src/man/kdb5_util.man | 2 +-
src/man/kdc.conf.man | 2 +-
src/man/kdestroy.man | 2 +-
src/man/kinit.man | 2 +-
src/man/klist.man | 2 +-
src/man/kpasswd.man | 2 +-
src/man/kprop.man | 2 +-
src/man/kpropd.man | 2 +-
src/man/kproplog.man | 2 +-
src/man/krb5-config.man | 2 +-
src/man/krb5.conf.man | 2 +-
src/man/krb5kdc.man | 2 +-
src/man/ksu.man | 2 +-
src/man/kswitch.man | 2 +-
src/man/ktutil.man | 2 +-
src/man/kvno.man | 2 +-
src/man/sclient.man | 2 +-
src/man/sserver.man | 2 +-
src/patchlevel.h | 6 ++--
src/po/mit-krb5.pot | 4 +-
28 files changed, 83 insertions(+), 30 deletions(-)
diff --git a/README b/README
index 007f48e..1a82219 100644
--- a/README
+++ b/README
@@ -74,6 +74,52 @@ variable that enables "weak" enctypes, which defaults to "false"
beginning with krb5-1.8.
+Major changes in 1.12.5 (2015-12-16)
+------------------------------------
+
+This is a bugfix release. The krb5-1.12 release series has reached
+the end of its maintenance period, and krb5-1.12.5 is the last planned
+release in the krb5-1.12 series. For new deployments, installers
+should prefer the krb5-1.14 release series or later.
+
+* Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
+ could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
+ [CVE-2015-2698]
+
+* Fix build_principal memory bug that could cause a KDC
+ crash. [CVE-2015-2697]
+
+* Allow an iprop slave to receive full resyncs from KDCs running
+ krb5-1.10 or earlier.
+
+krb5-1.12.5 changes by ticket ID
+--------------------------------
+
+8302 Document multi-component profile paths
+8303 Tolerate null oid pointer in gss_release_oid()
+8304 Fix leak in gss_acquire_cred_with_password
+8305 Fix uncommon null dereference in PKINIT client
+8306 Fix uncommon leak in krb5_init_creds_step()
+8307 Do not allow stream socket retries in libkrad
+8308 Fix gss_inquire_name() name_is_MN result
+8310 Check for null name_type in gss_display_name_ext
+8311 Fix error handling in gss_export_sec_context()
+8312 Fix KDC client referrals
+8313 SPNEGO and IAKERB context aliasing bugs [CVE-2015-2695][CVE-2015-2696]
+8314 Fix mechglue gss_acquire_cred_impersonate_name
+8315 Fix build_principal memory bug [CVE-2015-2697]
+8316 Fix IAKERB context export/import [CVE-2015-2698]
+8317 Fix compatibility with pre-1.11 iprop dump files
+8318 Remove ksu -D flag documentation
+8319 Untabify kerberos.schema and kerberos.ldif
+8320 Fix error mappings for IOV MIC mechglue funcs
+8321 Fix minor utf8-to-ucs2s read overrun bug
+8322 Define error status GSS_S_BAD_MIC
+8323 Fix typo in GSS_S_UNAUTHORIZED error message
+8324 Fix gss_inquire_names_for_mech() on MS krb5 mech
+8325 Check output params on GSS OID set functions
+
+
Major changes in 1.12.4 (2015-05-29)
------------------------------------
@@ -553,12 +599,14 @@ reports, suggestions, and valuable resources:
David Bantz
Alex Baule
David Benjamin
+ Thomas Bernard
Adam Bernstein
Arlene Berry
Jeff Blaine
Radoslav Bodo
Sumit Bose
Emmanuel Bouillon
+ Philip Brown
Michael Calmer
Andrea Campi
Julien Chaffraix
@@ -571,6 +619,7 @@ reports, suggestions, and valuable resources:
Kevin Coffman
Simon Cooper
Sylvain Cortes
+ Ian Crowther
Arran Cudbard-Bell
Jeff D'Angelo
Nalin Dahyabhai
@@ -592,6 +641,8 @@ reports, suggestions, and valuable resources:
Ronni Feldt
Bill Fellows
JC Ferguson
+ Remi Ferrand
+ Paul Fertser
William Fiveash
Ãkos Frohner
Sebastian Galiano
@@ -660,6 +711,7 @@ reports, suggestions, and valuable resources:
Mark Phalan
Brett Randall
Jonathan Reams
+ Jonathan Reed
Robert Relyea
Martin Rex
Jason Rogers
@@ -694,6 +746,7 @@ reports, suggestions, and valuable resources:
Ross Wilper
Augustin Wolf
David Woodhouse
+ Tsu-Phong Wu
Xu Qiang
Neng Xue
Nickolai Zeldovich
diff --git a/src/man/k5identity.man b/src/man/k5identity.man
index 73f392f..99a3e99 100644
--- a/src/man/k5identity.man
+++ b/src/man/k5identity.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "K5IDENTITY" "5" " " "1.12.4" "MIT Kerberos"
+.TH "K5IDENTITY" "5" " " "1.12.5" "MIT Kerberos"
.SH NAME
k5identity \- Kerberos V5 client principal selection rules
.
diff --git a/src/man/k5login.man b/src/man/k5login.man
index 92cc274..95aeacd 100644
--- a/src/man/k5login.man
+++ b/src/man/k5login.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "K5LOGIN" "5" " " "1.12.4" "MIT Kerberos"
+.TH "K5LOGIN" "5" " " "1.12.5" "MIT Kerberos"
.SH NAME
k5login \- Kerberos V5 acl file for host access
.
diff --git a/src/man/k5srvutil.man b/src/man/k5srvutil.man
index a8ee9f8..c248b7a 100644
--- a/src/man/k5srvutil.man
+++ b/src/man/k5srvutil.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "K5SRVUTIL" "1" " " "1.12.4" "MIT Kerberos"
+.TH "K5SRVUTIL" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
k5srvutil \- host key table (keytab) manipulation utility
.
diff --git a/src/man/kadm5.acl.man b/src/man/kadm5.acl.man
index 89cc5f4..956de20 100644
--- a/src/man/kadm5.acl.man
+++ b/src/man/kadm5.acl.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KADM5.ACL" "5" " " "1.12.4" "MIT Kerberos"
+.TH "KADM5.ACL" "5" " " "1.12.5" "MIT Kerberos"
.SH NAME
kadm5.acl \- Kerberos ACL file
.
diff --git a/src/man/kadmin.man b/src/man/kadmin.man
index 178679a..b3cc3e6 100644
--- a/src/man/kadmin.man
+++ b/src/man/kadmin.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KADMIN" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KADMIN" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
kadmin \- Kerberos V5 database administration program
.
diff --git a/src/man/kadmind.man b/src/man/kadmind.man
index ddf3375..fab7e3c 100644
--- a/src/man/kadmind.man
+++ b/src/man/kadmind.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KADMIND" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KADMIND" "8" " " "1.12.5" "MIT Kerberos"
.SH NAME
kadmind \- KADM5 administration server
.
diff --git a/src/man/kdb5_ldap_util.man b/src/man/kdb5_ldap_util.man
index 40a1172..4989006 100644
--- a/src/man/kdb5_ldap_util.man
+++ b/src/man/kdb5_ldap_util.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KDB5_LDAP_UTIL" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KDB5_LDAP_UTIL" "8" " " "1.12.5" "MIT Kerberos"
.SH NAME
kdb5_ldap_util \- Kerberos configuration utility
.
diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
index e258b7a..a403455 100644
--- a/src/man/kdb5_util.man
+++ b/src/man/kdb5_util.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KDB5_UTIL" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KDB5_UTIL" "8" " " "1.12.5" "MIT Kerberos"
.SH NAME
kdb5_util \- Kerberos database maintenance utility
.
diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index 65054e0..bb58669 100644
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KDC.CONF" "5" " " "1.12.4" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.12.5" "MIT Kerberos"
.SH NAME
kdc.conf \- Kerberos V5 KDC configuration file
.
diff --git a/src/man/kdestroy.man b/src/man/kdestroy.man
index 9a3f7c6..d8b237a 100644
--- a/src/man/kdestroy.man
+++ b/src/man/kdestroy.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KDESTROY" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KDESTROY" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
kdestroy \- destroy Kerberos tickets
.
diff --git a/src/man/kinit.man b/src/man/kinit.man
index c3cfbb4..974deaf 100644
--- a/src/man/kinit.man
+++ b/src/man/kinit.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KINIT" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KINIT" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
kinit \- obtain and cache Kerberos ticket-granting ticket
.
diff --git a/src/man/klist.man b/src/man/klist.man
index d597519..8c1379e 100644
--- a/src/man/klist.man
+++ b/src/man/klist.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KLIST" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KLIST" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
klist \- list cached Kerberos tickets
.
diff --git a/src/man/kpasswd.man b/src/man/kpasswd.man
index d3fb099..8fc6d56 100644
--- a/src/man/kpasswd.man
+++ b/src/man/kpasswd.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KPASSWD" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KPASSWD" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
kpasswd \- change a user's Kerberos password
.
diff --git a/src/man/kprop.man b/src/man/kprop.man
index efab59f1..ec81359 100644
--- a/src/man/kprop.man
+++ b/src/man/kprop.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KPROP" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KPROP" "8" " " "1.12.5" "MIT Kerberos"
.SH NAME
kprop \- propagate a Kerberos V5 principal database to a slave server
.
diff --git a/src/man/kpropd.man b/src/man/kpropd.man
index 89182f5..1175e7e 100644
--- a/src/man/kpropd.man
+++ b/src/man/kpropd.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KPROPD" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KPROPD" "8" " " "1.12.5" "MIT Kerberos"
.SH NAME
kpropd \- Kerberos V5 slave KDC update server
.
diff --git a/src/man/kproplog.man b/src/man/kproplog.man
index 40ccabc..15b23ba 100644
--- a/src/man/kproplog.man
+++ b/src/man/kproplog.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KPROPLOG" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KPROPLOG" "8" " " "1.12.5" "MIT Kerberos"
.SH NAME
kproplog \- display the contents of the Kerberos principal update log
.
diff --git a/src/man/krb5-config.man b/src/man/krb5-config.man
index d953296..d330e7f 100644
--- a/src/man/krb5-config.man
+++ b/src/man/krb5-config.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KRB5-CONFIG" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KRB5-CONFIG" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
krb5-config \- tool for linking against MIT Kerberos libraries
.
diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index b06d2f9..3b6d6e5 100644
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KRB5.CONF" "5" " " "1.12.4" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.12.5" "MIT Kerberos"
.SH NAME
krb5.conf \- Kerberos configuration file
.
diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
index 79677e0..96c0a32 100644
--- a/src/man/krb5kdc.man
+++ b/src/man/krb5kdc.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KRB5KDC" "8" " " "1.12.4" "MIT Kerberos"
+.TH "KRB5KDC" "8" " " "1.12.5" "MIT Kerberos"
.SH NAME
krb5kdc \- Kerberos V5 KDC
.
diff --git a/src/man/ksu.man b/src/man/ksu.man
index 42a88bb..2ad9601 100644
--- a/src/man/ksu.man
+++ b/src/man/ksu.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KSU" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KSU" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
ksu \- Kerberized super-user
.
diff --git a/src/man/kswitch.man b/src/man/kswitch.man
index 50afb40..d6746e2 100644
--- a/src/man/kswitch.man
+++ b/src/man/kswitch.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KSWITCH" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KSWITCH" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
kswitch \- switch primary ticket cache
.
diff --git a/src/man/ktutil.man b/src/man/ktutil.man
index cc6c046..fbb16f2 100644
--- a/src/man/ktutil.man
+++ b/src/man/ktutil.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KTUTIL" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KTUTIL" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
ktutil \- Kerberos keytab file maintenance utility
.
diff --git a/src/man/kvno.man b/src/man/kvno.man
index f9282fe..ce9b918 100644
--- a/src/man/kvno.man
+++ b/src/man/kvno.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KVNO" "1" " " "1.12.4" "MIT Kerberos"
+.TH "KVNO" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
kvno \- print key version numbers of Kerberos principals
.
diff --git a/src/man/sclient.man b/src/man/sclient.man
index 4f06722..687c71f 100644
--- a/src/man/sclient.man
+++ b/src/man/sclient.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "SCLIENT" "1" " " "1.12.4" "MIT Kerberos"
+.TH "SCLIENT" "1" " " "1.12.5" "MIT Kerberos"
.SH NAME
sclient \- sample Kerberos version 5 client
.
diff --git a/src/man/sserver.man b/src/man/sserver.man
index d642054..ee46ced 100644
--- a/src/man/sserver.man
+++ b/src/man/sserver.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "SSERVER" "8" " " "1.12.4" "MIT Kerberos"
+.TH "SSERVER" "8" " " "1.12.5" "MIT Kerberos"
.SH NAME
sserver \- sample Kerberos version 5 server
.
diff --git a/src/patchlevel.h b/src/patchlevel.h
index 1e6c4dd..252c56d 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -51,7 +51,7 @@
*/
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 12
-#define KRB5_PATCHLEVEL 4
-#define KRB5_RELTAIL "postrelease"
+#define KRB5_PATCHLEVEL 5
+/* #undef KRB5_RELTAIL */
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "krb5-1.12"
+#define KRB5_RELTAG "krb5-1.12.5-final"
diff --git a/src/po/mit-krb5.pot b/src/po/mit-krb5.pot
index 5be6122..61e7351 100644
--- a/src/po/mit-krb5.pot
+++ b/src/po/mit-krb5.pot
@@ -6,9 +6,9 @@
#, fuzzy
msgid ""
msgstr ""
-"Project-Id-Version: mit-krb5 1.12.4-postrelease\n"
+"Project-Id-Version: mit-krb5 1.12.5\n"
"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2015-12-14 15:34-0500\n"
+"POT-Creation-Date: 2015-12-14 16:59-0500\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL at ADDRESS>\n"
"Language-Team: LANGUAGE <LL at li.org>\n"
More information about the cvs-krb5
mailing list