[ubuntu/focal-security] krb5 1.17-6ubuntu4.8 (Accepted)

[Alex Murray]

krb5 (1.17-6ubuntu4.8) focal-security; urgency=medium

  * SECURITY UPDATE: Use of MD5-based message authentication over plaintext
    communications could lead to forgery attacks.
    - debian/patches/CVE-2024-3596.patch: Secure Response Authenticator
      by adding support for the Message-Authenticator attribute in non-EAP
      authentication methods.
    - debian/patches/0018-Convert-OTP-and-kdcproxy-tests-to-python3.patch:
      Convert tests/t_otp.py to python 3. Remove util/paste-kdcproxy.py and
      refactor it into util/wsgiref-kdcproxy.py to avoid paste dependency.
    - debian/patches/0019-More-python3-fixes-for-t_daemon.py: Replace a map
      with a list comprehension and update calls to StringIO in
      lib/krad/t_daemon.py.
    - CVE-2024-3596
  * Update libk5crypto3 symbols: add k5_hmac_md5 symbol.

krb5 (1.17-6ubuntu4.7) focal; urgency=medium

  * Fix a memory leak in krb5_gss_inquire_cred (LP: #2060666)

Date: 2025-02-04 15:18:11.034552+00:00
Changed-By: nicolas campuzano jimenez <nicolas.campuzano at canonical.com>
Signed-By: Alex Murray <alex.murray at canonical.com>
https://launchpad.net/ubuntu/+source/krb5/1.17-6ubuntu4.8
-------------- next part --------------
Sorry, changesfile not available.