Fedora 20 Update: krb5-1.11.5-4.fc20

updates at fedoraproject.org updates at fedoraproject.org
Fri Feb 28 18:39:31 UTC 2014 

--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2014-2579
2014-02-15 05:33:40
--------------------------------------------------------------------------------

Name        : krb5
Product     : Fedora 20
Version     : 1.11.5
Release     : 4.fc20
URL         : http://web.mit.edu/kerberos/www/
Summary     : The Kerberos network authentication system
Description :
Kerberos V5 is a trusted-third-party network authentication system,
which can improve your network's security by eliminating the insecure
practice of sending passwords over the network in unencrypted form.

--------------------------------------------------------------------------------
Update Information:

When the KDC is configured to use a local RADIUS server to verify one-time passwords, if there is no path for the socket explicitly configured, it will compute the socket path using a default directory and the name of the token type.

This update moves that default directory from the database directory (/var/kerberos/krb5kdc) to a new run-time directory (/var/run/krb5kdc), bringing it in line with future upstream releases.

This update also backports a fix which corrects a GSSAPI interoperability regression that could cause acceptor applications to generate tokens using a different mechanism OID than the one the initiator requested when using the SPNEGO mechanism.
--------------------------------------------------------------------------------
ChangeLog:

* Mon Feb 17 2014 Nalin Dahyabhai <nalin at redhat.com> - 1.11.5-4
- spnego: pull in patch from master to restore preserving the OID of the
  mechanism the initiator requested when we have multiple OIDs for the same
  mechanism, so that we reply using the same mechanism OID and the initiator
  doesn't get confused (#1066000, RT#7858)
* Mon Feb 10 2014 Nalin Dahyabhai <nalin at redhat.com> - 1.11.5-3
- pull in patch from master to move the default directory which the KDC uses
  when computing the socket path for a local OTP daemon from the database
  directory (/var/kerberos/krb5kdc) to the newly-added run directory
  (/run/krb5kdc), in line with what we're expecting in 1.13 (RT#7859, more
  of #1040056 as #1063905)
- add a tmpfiles.d configuration file to have /run/krb5kdc created at
  boot-time
- own /var/run/krb5kdc
* Fri Jan 31 2014 Nalin Dahyabhai <nalin at redhat.com> - 1.11.5-2
- rebuild because I tagged the previous package wrong
* Fri Jan 31 2014 Nalin Dahyabhai <nalin at redhat.com> - 1.11.5-1
- update to 1.11.5
  - remove patch for RT#7650, obsoleted in 1.11.4
  - remove patch for RT#7706, obsoleted in 1.11.4
  - remove patch for RT#7756 (CVE-2013-1418), obsoleted in 1.11.4
  - remove patch for RT#7668 (CVE-2013-1417), obsoleted in 1.11.4
  - remove patch for RT#7508, obsoleted in 1.11.4
  - remove patch for RT#7794, obsoleted in 1.11.4 as RT#7825
  - remove patch for RT#7797, obsoleted in 1.11.4 as RT#7827
  - remove patch for RT#7803, obsoleted in 1.11.4 as RT#7828
  - remove patch for RT#7805, obsoleted in 1.11.4 as RT#7829
  - remove patch for RT#7807, obsoleted in 1.11.4 as RT#7826
  - remove patch for RT#7045, obsoleted in 1.11.4 as RT#7823
* Fri Jan 31 2014 Nalin Dahyabhai <nalin at redhat.com> - 1.11.3-40
- add currently-proposed changes to teach ksu about credential cache
  collections and the default_ccache_name setting (#1015559,#1026099)
* Tue Jan 21 2014 Nalin Dahyabhai <nalin at redhat.com> - 1.11.3-39
- pull in upstream patch to fix the GSSAPI library's checks for expired
  client creds in gss_init_sec_context() so that they work with keyring
  caches (RT#7820, #1030607)
* Tue Jan 21 2014 Nalin Dahyabhai <nalin at redhat.com>
- pull in and backport multiple changes to allow replay caches to be added to
  a GSS credential store as "rcache"-type credentials (RT#7818/#7819/#7836,
* Thu Dec 19 2013 Nalin Dahyabhai <nalin at redhat.com> - 1.11.3-38
- pull in fix from master to make reporting of errors encountered by the SPNEGO
  mechanism work better (RT#7045, part of #1043962)
* Thu Dec 19 2013 Nalin Dahyabhai <nalin at redhat.com>
- update a test wrapper to properly handle things that the new libkrad does,
  and add python-pyrad as a build requirement so that we can run its tests
* Wed Dec 18 2013 Nalin Dahyabhai <nalin at redhat.com> - 1.11.3-37
- backport fixes to krb5_copy_context (RT#7807, #1044735/#1044739)
* Wed Dec 18 2013 Nalin Dahyabhai <nalin at redhat.com> - 1.11.3-36
- backport fix to avoid double-freeing in the client when we're configured
  to use a clpreauth module that isn't actually a clpreauth module (#1035203)
* Wed Dec 18 2013 Nalin Dahyabhai <nalin at redhat.com> - 1.11.3-35
- pull in fix from master to return a NULL pointer rather than allocating
  zero bytes of memory if we read a zero-length input token (RT#7794, part of
  - pull in fix from master to ignore an empty token from an acceptor if
  we've already finished authenticating (RT#7797, part of #1043962)
- pull in fix from master to avoid a memory leak when a mechanism's
  init_sec_context function fails (RT#7803, part of #1043962)
- pull in fix from master to avoid a memory leak in a couple of error
  cases which could occur while obtaining acceptor credentials (RT#7805, part
  of #1043962)
* Tue Dec 17 2013 Nalin Dahyabhai <nalin at redhat.com> - 1.11.3-34
- backport additional changes to libkrad to make it function more like
  the version in upstream 1.12, and a few things in the OTP plugin as well
  (most visibly, that the secret that's shared with the RADIUS server is read
  from a file rather than used directly) (#1040056)
--------------------------------------------------------------------------------
References:

  [ 1 ] Bug #1063905 - Move ipa-otpd socket directory
        https://bugzilla.redhat.com/show_bug.cgi?id=1063905
  [ 2 ] Bug #1066000 - Please backport SPNEGO fixes from upstream
        https://bugzilla.redhat.com/show_bug.cgi?id=1066000
--------------------------------------------------------------------------------

This update can be installed with the "yum" update program.  Use 
su -c 'yum update krb5' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key.  More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------

More information about the package-announce mailing list