krb5 commit [krb5-1.11]: Updates for krb5-1.11.6
Tom Yu
tlyu at mit.edu
Tue Feb 24 17:18:30 EST 2015
https://github.com/krb5/krb5/commit/2eaf99e5d272417405c1676fab22be345872bf85
commit 2eaf99e5d272417405c1676fab22be345872bf85
Author: Tom Yu <tlyu at mit.edu>
Date: Mon Feb 23 18:02:16 2015 -0500
Updates for krb5-1.11.6
README | 101 +++++++++++++++++++++++++++++++++++++++++++-
src/man/k5identity.man | 2 +-
src/man/k5login.man | 2 +-
src/man/k5srvutil.man | 2 +-
src/man/kadm5.acl.man | 2 +-
src/man/kadmin.man | 2 +-
src/man/kadmind.man | 2 +-
src/man/kdb5_ldap_util.man | 2 +-
src/man/kdb5_util.man | 2 +-
src/man/kdc.conf.man | 2 +-
src/man/kdestroy.man | 2 +-
src/man/kinit.man | 2 +-
src/man/klist.man | 2 +-
src/man/kpasswd.man | 2 +-
src/man/kprop.man | 2 +-
src/man/kpropd.man | 2 +-
src/man/kproplog.man | 2 +-
src/man/krb5-config.man | 2 +-
src/man/krb5.conf.man | 2 +-
src/man/krb5kdc.man | 2 +-
src/man/ksu.man | 2 +-
src/man/kswitch.man | 2 +-
src/man/ktutil.man | 2 +-
src/man/kvno.man | 2 +-
src/man/sclient.man | 2 +-
src/man/sserver.man | 2 +-
src/patchlevel.h | 6 +-
src/po/mit-krb5.pot | 4 +-
28 files changed, 129 insertions(+), 32 deletions(-)
diff --git a/README b/README
index e34436b..5c34ece 100644
--- a/README
+++ b/README
@@ -6,7 +6,7 @@
Copyright and Other Notices
---------------------------
-Copyright (C) 1985-2014 by the Massachusetts Institute of Technology
+Copyright (C) 1985-2015 by the Massachusetts Institute of Technology
and its contributors. All rights reserved.
Please see the file named NOTICE for additional notices.
@@ -73,6 +73,103 @@ from using single-DES cryptosystems. Among these is a configuration
variable that enables "weak" enctypes, which defaults to "false"
beginning with krb5-1.8.
+Major changes in 1.11.6 (2015-02-24)
+------------------------------------
+
+This is a bugfix release. The krb5-1.11 release series has reached
+the end of its maintenance period, and krb5-1.11.6 is the last planned
+release in the krb5-1.11 series. For new deployments, installers
+should prefer the krb5-1.13 release series or later.
+
+* Work around a gcc optimizer bug that could cause DB2 KDC database
+ operations to spin in an infinite loop
+
+* Fix a backward compatibility problem with the LDAP KDB schema that
+ could prevent krb5-1.11 and later from decoding entries created by
+ krb5-1.6.
+
+* Handle certain invalid RFC 1964 GSS tokens correctly to avoid
+ invalid memory reference vulnerabilities. [CVE-2014-4341
+ CVE-2014-4342]
+
+* Fix memory management vulnerabilities in GSSAPI SPNEGO.
+ [CVE-2014-4343 CVE-2014-4344]
+
+* Fix buffer overflow vulnerability in LDAP KDB back end.
+ [CVE-2014-4345]
+
+* Fix multiple vulnerabilities in the LDAP KDC back end.
+ [CVE-2014-5354 CVE-2014-5353]
+
+* Fix multiple kadmind vulnerabilities, some of which are based in the
+ gssrpc library. [CVE-2014-5352 CVE-2014-9421 CVE-2014-9422
+ CVE-2014-9423]
+
+krb5-1.11.6 changes by ticket ID
+--------------------------------
+
+7867 Fix memory leak in patch for #7831
+8073 Fix gss_process_context_token() [CVE-2014-5352]
+8074 Fix kadm5/gssrpc XDR double free [CVE-2014-9421]
+8075 Fix kadmind server validation [CVE-2014-9422]
+8076 Fix gssrpc data leakage [CVE-2014-9423]
+8077 Clean up rcache if GSS krb5 acquire_cred fails
+8078 Avoid assertion failure in error_message
+8079 Allow empty store in gss_acquire_cred_from
+8080 Fix kpropd -x
+8081 Properly reflect MS krb5 mech in SPNEGO acceptor
+8082 Update doc build instructions
+8083 Support referrals from Windows Server 2003
+8084 Avoid duplicate "/etc/krb5.conf" in profile path
+8085 Correct docs for "kdb5_util load" switches
+8086 Check for malloc failure in process_chpw_request
+8087 Update iprop_master_ulogsize documentation
+8088 Initialize err variable in krb5_sendto_kdc
+8089 Fix memory leak in krb5_verify_init_creds
+8090 Mention k5login_authoritative in k5login docs
+8091 Fix unlikely double free in PKINIT client code
+8092 Fix returning KDB_NOENTRY in find_alternate_tgs()
+8093 Update example kadmin getprinc enctype display
+8094 Fix GSS krb5 initial sequence number gap handling
+8095 Get getopt from unistd.h (not getopt.h) in tests
+8096 Fix leak in kadm5_flush with LDAP KDB
+8097 Check for asprintf failure in kdb5_util create
+8098 Fix krb5int_c_combine_keys
+8099 Add tests for krb5int_c_combine_keys
+8100 Don't blindly use PKCS11 slot IDs in PKINIT
+8101 Do not document pkinit_mapping_file
+8102 Always include salt in LDAP KrbKey encoding
+8103 Add missing profile functions to libkrb5 exports
+8104 Do not document pkinit_win2k
+8105 Improve PKINIT certificate documentation
+8106 Fix error checking in PKINIT authdata creation
+8107 Fix unlikely null dereference in mk_cred()
+8108 Handle invalid RFC 1964 tokens [CVE-2014-4341 CVE-2014-4342]
+8109 Fix KDC worker process argument parsing
+8110 Fix build on systems without RTM_OLD*
+8111 Fix race in util/profile/Makefile.in
+8112 Fix calloc check in krb5_authdata_context_init
+8113 Fix double-free in SPNEGO [CVE-2014-4343]
+8114 NULL dereference in SPNEGO acceptor for continuation tokens
+ [CVE-2014-4344]
+8115 Remove indent workaround in man page RST sources
+8116 Use TAILQ macros instead of CIRCLEQ in libdb2
+8117 Fix deleted node handling in libprofile
+8118 Fix creation/rename of top-level profile sections
+8119 Use zapfree in krb5_decrypt_tkt_part
+8120 Fix LDAP key data segmentation [CVE-2014-4345]
+8121 Make tcl_kadm5.c work with Tcl 8.6
+8122 kinit -C loops chasing realm referrals against MIT KDC
+8140 Export function gss_add_cred_with_password
+8141 Check for null *iter_p in profile_iterator()
+8142 Fix LDAP misused policy name crash [CVE-2014-5353]
+8143 Update example enctypes in kdc_conf.rst
+8144 Fix cursor leak in krb5_verify_init_creds
+8145 Report output ccache errors getting initial creds
+8146 Fix typo in doc for krb5_get_init_creds_keytab()
+8147 Fix input race condition in t_skew.py
+8148 Parse "ktadd -norandkey" in remote kadmin client
+
Major changes in 1.11.5 (2014-01-21)
------------------------------------
@@ -83,7 +180,7 @@ Major changes in 1.11.5 (2014-01-21)
* Improve documentation.
-krb5-1.11.4 changes by ticket ID
+krb5-1.11.5 changes by ticket ID
--------------------------------
7760 Fix use-before-init in two test programs
diff --git a/src/man/k5identity.man b/src/man/k5identity.man
index 6024a24..417bfd1 100644
--- a/src/man/k5identity.man
+++ b/src/man/k5identity.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "K5IDENTITY" "5" " " "1.11.5" "MIT Kerberos"
+.TH "K5IDENTITY" "5" " " "1.11.6" "MIT Kerberos"
.SH NAME
k5identity \- Kerberos V5 client principal selection rules
.
diff --git a/src/man/k5login.man b/src/man/k5login.man
index 653cf88..2fa542f 100644
--- a/src/man/k5login.man
+++ b/src/man/k5login.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "K5LOGIN" "5" " " "1.11.5" "MIT Kerberos"
+.TH "K5LOGIN" "5" " " "1.11.6" "MIT Kerberos"
.SH NAME
k5login \- Kerberos V5 acl file for host access
.
diff --git a/src/man/k5srvutil.man b/src/man/k5srvutil.man
index a0ff780..33984ec 100644
--- a/src/man/k5srvutil.man
+++ b/src/man/k5srvutil.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "K5SRVUTIL" "1" " " "1.11.5" "MIT Kerberos"
+.TH "K5SRVUTIL" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
k5srvutil \- host key table (keytab) manipulation utility
.
diff --git a/src/man/kadm5.acl.man b/src/man/kadm5.acl.man
index e754d15..29196a0 100644
--- a/src/man/kadm5.acl.man
+++ b/src/man/kadm5.acl.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KADM5.ACL" "5" " " "1.11.5" "MIT Kerberos"
+.TH "KADM5.ACL" "5" " " "1.11.6" "MIT Kerberos"
.SH NAME
kadm5.acl \- Kerberos ACL file
.
diff --git a/src/man/kadmin.man b/src/man/kadmin.man
index b4ec198..6afe6b2 100644
--- a/src/man/kadmin.man
+++ b/src/man/kadmin.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KADMIN" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KADMIN" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
kadmin \- Kerberos V5 database administration program
.
diff --git a/src/man/kadmind.man b/src/man/kadmind.man
index 26be3ad..3ddaac9 100644
--- a/src/man/kadmind.man
+++ b/src/man/kadmind.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KADMIND" "8" " " "1.11.5" "MIT Kerberos"
+.TH "KADMIND" "8" " " "1.11.6" "MIT Kerberos"
.SH NAME
kadmind \- KADM5 administration server
.
diff --git a/src/man/kdb5_ldap_util.man b/src/man/kdb5_ldap_util.man
index 74bc45a6e..aeab724 100644
--- a/src/man/kdb5_ldap_util.man
+++ b/src/man/kdb5_ldap_util.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KDB5_LDAP_UTIL" "8" " " "1.11.5" "MIT Kerberos"
+.TH "KDB5_LDAP_UTIL" "8" " " "1.11.6" "MIT Kerberos"
.SH NAME
kdb5_ldap_util \- Kerberos configuration utility
.
diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
index b465780..9dd2b64 100644
--- a/src/man/kdb5_util.man
+++ b/src/man/kdb5_util.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KDB5_UTIL" "8" " " "1.11.5" "MIT Kerberos"
+.TH "KDB5_UTIL" "8" " " "1.11.6" "MIT Kerberos"
.SH NAME
kdb5_util \- Kerberos database maintenance utility
.
diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index beff017..94bf4e2 100644
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KDC.CONF" "5" " " "1.11.5" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.11.6" "MIT Kerberos"
.SH NAME
kdc.conf \- Kerberos V5 KDC configuration file
.
diff --git a/src/man/kdestroy.man b/src/man/kdestroy.man
index e31e10c..4c6a6f9 100644
--- a/src/man/kdestroy.man
+++ b/src/man/kdestroy.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KDESTROY" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KDESTROY" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
kdestroy \- destroy Kerberos tickets
.
diff --git a/src/man/kinit.man b/src/man/kinit.man
index 696fa67..08945ae 100644
--- a/src/man/kinit.man
+++ b/src/man/kinit.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KINIT" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KINIT" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
kinit \- obtain and cache Kerberos ticket-granting ticket
.
diff --git a/src/man/klist.man b/src/man/klist.man
index d20ff35..8e02b7a 100644
--- a/src/man/klist.man
+++ b/src/man/klist.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KLIST" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KLIST" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
klist \- list cached Kerberos tickets
.
diff --git a/src/man/kpasswd.man b/src/man/kpasswd.man
index a758eda..f5503c6 100644
--- a/src/man/kpasswd.man
+++ b/src/man/kpasswd.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KPASSWD" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KPASSWD" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
kpasswd \- change a user's Kerberos password
.
diff --git a/src/man/kprop.man b/src/man/kprop.man
index 38f9478..24411f6 100644
--- a/src/man/kprop.man
+++ b/src/man/kprop.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KPROP" "8" " " "1.11.5" "MIT Kerberos"
+.TH "KPROP" "8" " " "1.11.6" "MIT Kerberos"
.SH NAME
kprop \- propagate a Kerberos V5 principal database to a slave server
.
diff --git a/src/man/kpropd.man b/src/man/kpropd.man
index edfbd57..f0f2be2 100644
--- a/src/man/kpropd.man
+++ b/src/man/kpropd.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KPROPD" "8" " " "1.11.5" "MIT Kerberos"
+.TH "KPROPD" "8" " " "1.11.6" "MIT Kerberos"
.SH NAME
kpropd \- Kerberos V5 slave KDC update server
.
diff --git a/src/man/kproplog.man b/src/man/kproplog.man
index 192dd29..f6fca3f 100644
--- a/src/man/kproplog.man
+++ b/src/man/kproplog.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KPROPLOG" "8" " " "1.11.5" "MIT Kerberos"
+.TH "KPROPLOG" "8" " " "1.11.6" "MIT Kerberos"
.SH NAME
kproplog \- display the contents of the Kerberos principal update log
.
diff --git a/src/man/krb5-config.man b/src/man/krb5-config.man
index c123795..663a173 100644
--- a/src/man/krb5-config.man
+++ b/src/man/krb5-config.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KRB5-CONFIG" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KRB5-CONFIG" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
krb5-config \- tool for linking against MIT Kerberos libraries
.
diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index a225af9..65377da 100644
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KRB5.CONF" "5" " " "1.11.5" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.11.6" "MIT Kerberos"
.SH NAME
krb5.conf \- Kerberos configuration file
.
diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
index 6306ec2..0935dcc 100644
--- a/src/man/krb5kdc.man
+++ b/src/man/krb5kdc.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KRB5KDC" "8" " " "1.11.5" "MIT Kerberos"
+.TH "KRB5KDC" "8" " " "1.11.6" "MIT Kerberos"
.SH NAME
krb5kdc \- Kerberos V5 KDC
.
diff --git a/src/man/ksu.man b/src/man/ksu.man
index 283a43c..495ad38 100644
--- a/src/man/ksu.man
+++ b/src/man/ksu.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KSU" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KSU" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
ksu \- Kerberized super-user
.
diff --git a/src/man/kswitch.man b/src/man/kswitch.man
index 40b6fef..908e999 100644
--- a/src/man/kswitch.man
+++ b/src/man/kswitch.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KSWITCH" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KSWITCH" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
kswitch \- switch primary ticket cache
.
diff --git a/src/man/ktutil.man b/src/man/ktutil.man
index dd89b0b..9ea2f2a 100644
--- a/src/man/ktutil.man
+++ b/src/man/ktutil.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KTUTIL" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KTUTIL" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
ktutil \- Kerberos keytab file maintenance utility
.
diff --git a/src/man/kvno.man b/src/man/kvno.man
index d244d46..9a8eeb2 100644
--- a/src/man/kvno.man
+++ b/src/man/kvno.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "KVNO" "1" " " "1.11.5" "MIT Kerberos"
+.TH "KVNO" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
kvno \- print key version numbers of Kerberos principals
.
diff --git a/src/man/sclient.man b/src/man/sclient.man
index 97fe08a..1fb295e 100644
--- a/src/man/sclient.man
+++ b/src/man/sclient.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "SCLIENT" "1" " " "1.11.5" "MIT Kerberos"
+.TH "SCLIENT" "1" " " "1.11.6" "MIT Kerberos"
.SH NAME
sclient \- sample Kerberos version 5 client
.
diff --git a/src/man/sserver.man b/src/man/sserver.man
index 6c72ca1..98dd74a 100644
--- a/src/man/sserver.man
+++ b/src/man/sserver.man
@@ -1,6 +1,6 @@
.\" Man page generated from reStructuredText.
.
-.TH "SSERVER" "8" " " "1.11.5" "MIT Kerberos"
+.TH "SSERVER" "8" " " "1.11.6" "MIT Kerberos"
.SH NAME
sserver \- sample Kerberos version 5 server
.
diff --git a/src/patchlevel.h b/src/patchlevel.h
index cc78cec..2534e28 100644
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -51,7 +51,7 @@
*/
#define KRB5_MAJOR_RELEASE 1
#define KRB5_MINOR_RELEASE 11
-#define KRB5_PATCHLEVEL 5
-#define KRB5_RELTAIL "postrelease"
+#define KRB5_PATCHLEVEL 6
+/* #undef KRB5_RELTAIL */
/* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "krb5-1.11"
+#define KRB5_RELTAG "krb5-1.11.6-final"
diff --git a/src/po/mit-krb5.pot b/src/po/mit-krb5.pot
index ba9b7cf..4089aed 100644
--- a/src/po/mit-krb5.pot
+++ b/src/po/mit-krb5.pot
@@ -6,9 +6,9 @@
#, fuzzy
msgid ""
msgstr ""
-"Project-Id-Version: mit-krb5 1.11.5-postrelease\n"
+"Project-Id-Version: mit-krb5 1.11.6\n"
"Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2015-02-23 14:19-0500\n"
+"POT-Creation-Date: 2015-02-23 18:14-0500\n"
"PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
"Last-Translator: FULL NAME <EMAIL at ADDRESS>\n"
"Language-Team: LANGUAGE <LL at li.org>\n"
More information about the cvs-krb5
mailing list