From ghudson at mit.edu Mon Nov 9 12:05:13 2026 From: ghudson at mit.edu (Greg Hudson) Date: Mon, 9 Nov 2026 12:05:13 -0500 Subject: krb5-1.22.3 is released Message-ID: <54f6f840-8c9b-4bb0-8d65-6957229a439d@mit.edu> The MIT Kerberos Team announces the availability of MIT Kerberos 5 Release 1.22.3. Please see below for a list of some major changes included, or consult the README file in the source tree for a more detailed list of significant changes. RETRIEVING KERBEROS 5 RELEASE 1.22.3 ==================================== You may retrieve the Kerberos 5 Release 1.22.3 source from the following URL: https://kerberos.org/dist/ The homepage for the krb5-1.22.3 release is: https://web.mit.edu/kerberos/krb5-1.23/ Further information about Kerberos 5 may be found at the following URL: https://web.mit.edu/kerberos/ and at the MIT Kerberos Consortium web site: https://www.kerberos.org/ Major changes in 1.22.3 (2026-11-09) ==================================== This is a bug fix release, with a focus on security issues discovered with the aid of large language models. See https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for information on the risks of continuing to use unpatched releases. * Fix a logic error when checking PAC server checksums [CVE-2026-111423]. * Check for unkeyed checksums when validating CAMMAC verifiers [CVE-2026-71199]. * Fix a loophole in the KDC's client authdata filtering which could allow clients to include fake PAC and CAMMAC authdata values when requesting service tickets. These fake values would be rejected by application servers, were it not for the two bugs noted above. * Check for the lockdown_keys attribute when processing password change protocol requests in kadmind [CVE-2026-107884]. * In libgssrpc, when processing RPC messages using the RPCSEC_GSS flavor, use the verified service type included in the RPC request to determine how to unwrap arguments and wrap return values, instead of the unverified service type included during authentication [CVE-2026-118380]. * In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the "GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set. AUTH_GSSAPI is only needed for very old (pre-1.4) clients [CVE-2026-112322] [CVE-2026-112323]. * Fix numerous null pointer deferences, read overruns, unbounded memory allocations, and memory leaks that could be used as denial of service attacks against the KDC, kadmind, application servers, or client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200] [CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778] [CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316] [CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319] [CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323] [CVE-2026-119079]. * Fix a client crash when a KKDCP proxy daemon closes the TLS session without supplying any response data. * Shut down kpropd gracefully when a termination signal is received, when operating in incremental propagation mode. * Detect when an incremental propagation update is applied to a nonexistent principal; when this happens, force a full resync instead of crashing. * Fix a KDC crash when the LDAP KDB module loses its connection to the LDAP server. * Avoid a crash on macOS when the native API ccache type is used before and after forking a process. * When an application accepts a GSS context without asking for delegated credentials, discard any credentials sent by the initiator without parsing them first. * On Windows, prevent buffer overflows when the KDC sends an unexpectedly long prompt string via OTP preauthentication. * On Windows, move the default per-machine krb5.ini location from C:\ProgramData\MIT\Kerberos to C:\Program Files\MIT\Kerberos5, as the former location could be pre-created by an unutrusted user before KfW installation. * On Windows, add error checking to kfwlogon to ensure that it does not set ACLs on a cache file it did not create. * On Windows, prevent several buffer overflows that could occur if an application passes a large principal name to leashdll APIs. * On Windows, prevent buffer overflows when the LSA cache contains credentials with long principal name components. From ghudson at mit.edu Thu Nov 12 20:46:48 2026 From: ghudson at mit.edu (Greg Hudson) Date: Thu, 12 Nov 2026 20:46:48 -0500 Subject: Kerberos for Windows release 4.4 is now available Message-ID: The MIT Kerberos Team announces the availability of the kfw-4.4 release. The KfW 4.4 series of releases is based on the MIT krb5 1.22 series of releases, modernizing the support relative to the KfW 4.1 series, which was based on the MIT krb5 1.13 series. The initial 4.4 release is based on MIT krb5 release 1.22.3, and contains a build of OpenSSL 4.0.3 which is used by PKINIT. KfW 4.4 is distributed as a Windows Installer MSI file for 64-bit systems. The MSI installer has been digitally signed by MIT. KfW has been tested on Windows 11, and is believed to work on Windows 7 and current Windows Server releases. Retrieving Kerberos for Windows release 4.4 =========================================== You may retrieve the kfw-4.4 installer from the following URL: https://kerberos.org/dist/ The homepage for the kfw-4.4 release is: https://web.mit.edu/kerberos/kfw-4.4/kfw-4.4.html Further information about MIT Kerberos software may be found at the following URL: https://web.mit.edu/kerberos/ Major changes in 4.4 ==================== * The default machine-wide configuration file location has been changed from C:\ProgramData\MIT\Kerberos\krb5.ini to C:\Program Files\MIT\Kerberos5\krb5.ini. * PKINIT and SPAKE pre-authentication are supported. * Only 64-bit binaries and libraries are included. * Updates from the 1.14 through 1.22 krb5 release notes are applicable.