rpms/krb5
7
0
Fork 0
Code Issues Pull Requests Releases Activity

import CS git krb5-1.18.2-34.el8_10

Browse Source
This commit is contained in:
AlmaLinux RelEng Bot 2026-05-13 02:23:32 -04:00
parent 7419bc11ae
commit 5c764f32d9
2 changed files with 71 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
SOURCES/Fix-two-NegoEx-parsing-vulnerabilities.patch Normal file
View File

@ -0,0 +1,65 @@
From 317d6cc21d12148bbb1366b6d143c1913bff4d80 Mon Sep 17 00:00:00 2001
From: Greg Hudson <ghudson@mit.edu>
Date: Wed, 8 Apr 2026 17:57:59 -0400
Subject: [PATCH] Fix two NegoEx parsing vulnerabilities
In parse_nego_message(), check the result of the second call to
vector_base() before dereferencing it. In parse_message(), check for
a short header_len to prevent an integer underflow when calculating
the remaining message length.
Reported by Cem Onat Karagun.
CVE-2026-40355:
In MIT krb5 release 1.18 and later, if an application calls
gss_accept_sec_context() on a system with a NegoEx mechanism
registered in /etc/gss/mech, an unauthenticated remote attacker can
trigger a null pointer dereference, causing the process to terminate.
CVE-2026-40356:
In MIT krb5 release 1.18 and later, if an application calls
gss_accept_sec_context() on a system with a NegoEx mechanism
registered in /etc/gss/mech, an unauthenticated remote attacker can
trigger a read overrun of up to 52 bytes, possibly causing the process
to terminate. Exfiltration of the bytes read does not appear
possible.
ticket: 9205 (new)
tags: pullup
target_version: 1.22-next
(cherry picked from commit 2e75f0d9362fb979f5fc92829431a590a130929f)
---
src/lib/gssapi/spnego/negoex_util.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/src/lib/gssapi/spnego/negoex_util.c b/src/lib/gssapi/spnego/negoex_util.c
index 99580fd79c..632f719ba8 100644
--- a/src/lib/gssapi/spnego/negoex_util.c
+++ b/src/lib/gssapi/spnego/negoex_util.c
@@ -253,6 +253,10 @@ parse_nego_message(OM_uint32 *minor, struct k5input *in,
offset = k5_input_get_uint32_le(in);
count = k5_input_get_uint16_le(in);
p = vector_base(offset, count, EXTENSION_LENGTH, msg_base, msg_len);
+ if (p == NULL) {
+ *minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
+ return GSS_S_DEFECTIVE_TOKEN;
+ }
for (i = 0; i < count; i++) {
extension_type = load_32_le(p + i * EXTENSION_LENGTH);
if (extension_type & EXTENSION_FLAG_CRITICAL) {
@@ -391,7 +395,8 @@ parse_message(OM_uint32 *minor, spnego_gss_ctx_id_t ctx, struct k5input *in,
msg_len = k5_input_get_uint32_le(in);
conv_id = k5_input_get_bytes(in, GUID_LENGTH);
- if (in->status || msg_len > token_remaining || header_len > msg_len) {
+ if (in->status || msg_len > token_remaining ||
+ header_len < (size_t)(in->ptr - msg_base) || header_len > msg_len) {
*minor = ERR_NEGOEX_INVALID_MESSAGE_SIZE;
return GSS_S_DEFECTIVE_TOKEN;
}
--
2.53.0

7
SPECS/krb5.spec
View File

@ -18,7 +18,7 @@ Summary: The Kerberos network authentication system
Name: krb5
Version: 1.18.2
# for prerelease, should be e.g., 0.% {prerelease}.1% { ?dist } (without spaces)
Release: 33%{?dist}
Release: 34%{?dist}
# lookaside-cached sources; two downloads and a build artifact
Source0: https://web.mit.edu/kerberos/dist/krb5/1.18/krb5-%{version}%{prerelease}.tar.gz
@ -118,6 +118,7 @@ Patch172: Add-PKINIT-paChecksum2-from-MS-PKCA-v20230920.patch
Patch173: downstream-Do-not-block-HMAC-MD4-5-in-FIPS-mode.patch
Patch174: Improve-ulog-block-resize-efficiency.patch
Patch175: Fix-uninitialized-pointer-dereference-in-libkrad.patch
Patch176: Fix-two-NegoEx-parsing-vulnerabilities.patch
License: MIT
URL: http://web.mit.edu/kerberos/www/
@ -728,6 +729,10 @@ exit 0
%{_libdir}/libkadm5srv_mit.so.*
%changelog
* Tue Apr 28 2026 Julien Rische <jrische@redhat.com> - 1.18.2-34
- Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
Resolves: RHEL-171589 RHEL-171594
* Wed Jan 28 2026 Julien Rische <jrische@redhat.com> - 1.18.2-33
- krad: packet ID fetched from uninitialized variable
Resolves: RHEL-109220