krb5-1.15.2 is released

[Greg Hudson]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

The MIT Kerberos Team announces the availability of MIT Kerberos 5
Release 1.15.2.  Please see below for a list of some major changes
included, or consult the README file in the source tree for a more
detailed list of significant changes.

RETRIEVING KERBEROS 5 RELEASE 1.15.2
====================================

You may retrieve the Kerberos 5 Release 1.15.2 source from the
following URL:

        http://web.mit.edu/kerberos/dist/

The homepage for the krb5-1.15.2 release is:

        http://web.mit.edu/kerberos/krb5-1.15/

Further information about Kerberos 5 may be found at the following
URL:

        http://web.mit.edu/kerberos/

and at the MIT Kerberos Consortium web site:

        http://www.kerberos.org/

DES transition
==============

The Data Encryption Standard (DES) is widely recognized as weak.  The
krb5-1.7 release contains measures to encourage sites to migrate away
from using single-DES cryptosystems.  Among these is a configuration
variable that enables "weak" enctypes, which defaults to "false"
beginning with krb5-1.8.

Major changes in 1.15.2 (2017-09-25)
====================================

This is a bug fix release.

* Fix a KDC denial of service vulnerability caused by unset status
  strings [CVE-2017-11368]

* Preserve GSS contexts on init/accept failure [CVE-2017-11462]

* Fix kadm5 setkey operation with LDAP KDB module

* Use a ten-second timeout after successful connection for HTTPS KDC
  requests, as we do for TCP requests

* Fix client null dereference when KDC offers encrypted challenge
  without FAST

* Ignore dotfiles when processing profile includedir directive

* Improve documentation

Major changes in 1.15.1 (2017-03-01)
====================================

This is a bug fix release.

* Allow KDB modules to determine how the e_data field of principal
  fields is freed

* Fix udp_preference_limit when the KDC location is configured with
  SRV records

* Fix KDC and kadmind startup on some IPv4-only systems

* Fix the processing of PKINIT certificate matching rules which have
  two components and no explicit relation

* Improve documentation

Major changes in 1.15 (2016-12-01)
==================================

Administrator experience:

* Improve support for multihomed Kerberos servers by adding options
  for specifying restricted listening addresses for the KDC and
  kadmind.

* Add support to kadmin for remote extraction of current keys without
  changing them (requires a special kadmin permission that is excluded
  from the wildcard permission), with the exception of highly
  protected keys.

* Add a lockdown_keys principal attribute to prevent retrieval of the
  principal's keys (old or new) via the kadmin protocol.  In newly
  created databases, this attribute is set on the krbtgt and kadmin
  principals.

* Restore recursive dump capability for DB2 back end, so sites can
  more easily recover from database corruption resulting from power
  failure events.

* Add DNS auto-discovery of KDC and kpasswd servers from URI records,
 in addition to SRV records.  URI records can convey TCP and UDP
 servers and master KDC status in a single DNS lookup, and can also
 point to HTTPS proxy servers.

* Add support for password history to the LDAP back end.

* Add support for principal renaming to the LDAP back end.

* Use the getrandom system call on supported Linux kernels to avoid
  blocking problems when getting entropy from the operating system.

* In the PKINIT client, use the correct DigestInfo encoding for PKCS
  #1 signatures, so that some especially strict smart cards will work.

Code quality:

* Clean up numerous compilation warnings.

* Remove various infrequently built modules, including some preauth
  modules that were not built by default.

Developer experience:

* Add support for building with OpenSSL 1.1.

* Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
  authenticators in the replay cache.  This helps sites that must
  build with FIPS 140 conformant libraries that lack MD5.

* Eliminate util/reconf and allow the use of autoreconf alone to
  regenerate the configure script.

Protocol evolution:

* Add support for the AES-SHA2 enctypes, which allows sites to conform
  to Suite B crypto requirements.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBWclARAy6CFdfg3LfAQKaQhAA1JggQ+mNreNqVGd7oKeAlrMoDRLGCaHT
g4APGIju1YkFs6n4XGFiHNNGGsB4vtoIMMBBbV6vPvzPxXdQEmJSKD774odAnd9l
8LAvx+MG/t9QcHt22CPY6DO/mimHOOlwwfh6qwIqoE9SEJ7ybfJxbpiWaYYme7rj
eq90ArX5w+AbZBtWBv0S7J7z5RQliAcJvcxWF3JZZB+JlFjYpJAvkzqNGp3ObZeY
WYq7eDfnx49hiwTL4OVxc4Ce6Oc0mQKZ6CPZPec3vBIEZNOBc4Dnvzkr7alBkXEM
ImbreHdHOk8/XJBead2xOhR6E5tSoF4PXubG6MHKqZ3utbIcHAdwutjzlniUKWtg
Tn57KljWbpkFQaZ8x5Dfz3zrkx2pHsOqNUGkwtLD7wFM9rYNWPVEnp+Hu1e0JtUe
3Ozn32bmkkoxF1y9uuIFX+iFAzcSls5Lrh+RMmDCsAn7FLuPMp0iydr+55N2tqB8
CLyUPigIL4yNOXFBRdIMfenwUJJ2OTV7xH9XCRklFYGaCS2+GQ8X3GC5aK3255nc
DQBEtdEDM9YrB06+ecUjlHAtm41Hz/pJnLfkrlj9oT7rmT1JjMSDANC+SnZD9234
iCoO3l41Lej8ywHjsazTaMNxcmm09lpx1VMztdrXWPYYEQSEMd5RawWgjzerGOKn
8LgfORQJu54=
=AxBU
-----END PGP SIGNATURE-----