USN-5828-1: Kerberos vulnerabilities
25 January 2023
Several security issues were fixed in Kerberos.
Releases
Packages
- krb5 - MIT Kerberos Network Authentication Protocol
Details
It was discovered that Kerberos incorrectly handled certain S4U2Self
requests. An attacker could possibly use this issue to cause a denial of
service. This issue was only addressed in Ubuntu 16.04 ESM and Ubuntu
18.04 LTS. (CVE-2018-20217)
Greg Hudson discovered that Kerberos PAC implementation incorrectly
handled certain parsing operations. A remote attacker could use this
issue to cause a denial of service, or possibly execute arbitrary code.
(CVE-2022-42898)
Update instructions
The problem can be corrected by updating your system to the following package versions:
Ubuntu 22.10
-
krb5-user
-
1.20-1ubuntu0.1
-
libkdb5-10
-
1.20-1ubuntu0.1
-
libgssapi-krb5-2
-
1.20-1ubuntu0.1
-
krb5-kdc
-
1.20-1ubuntu0.1
-
krb5-admin-server
-
1.20-1ubuntu0.1
Ubuntu 22.04
-
krb5-user
-
1.19.2-2ubuntu0.1
-
libkdb5-10
-
1.19.2-2ubuntu0.1
-
libgssapi-krb5-2
-
1.19.2-2ubuntu0.1
-
krb5-kdc
-
1.19.2-2ubuntu0.1
-
krb5-admin-server
-
1.19.2-2ubuntu0.1
Ubuntu 20.04
-
libkdb5-9
-
1.17-6ubuntu4.2
-
krb5-user
-
1.17-6ubuntu4.2
-
libgssapi-krb5-2
-
1.17-6ubuntu4.2
-
krb5-kdc
-
1.17-6ubuntu4.2
-
krb5-admin-server
-
1.17-6ubuntu4.2
Ubuntu 18.04
-
libkdb5-9
-
1.16-2ubuntu0.3
-
krb5-user
-
1.16-2ubuntu0.3
-
libgssapi-krb5-2
-
1.16-2ubuntu0.3
-
krb5-kdc
-
1.16-2ubuntu0.3
-
krb5-admin-server
-
1.16-2ubuntu0.3
Ubuntu 16.04
-
krb5-user
-
1.13.2+dfsg-5ubuntu2.2+esm3
Available with Ubuntu Pro
-
libgssapi-krb5-2
-
1.13.2+dfsg-5ubuntu2.2+esm3
Available with Ubuntu Pro
-
krb5-kdc
-
1.13.2+dfsg-5ubuntu2.2+esm3
Available with Ubuntu Pro
-
libkdb5-8
-
1.13.2+dfsg-5ubuntu2.2+esm3
Available with Ubuntu Pro
-
krb5-admin-server
-
1.13.2+dfsg-5ubuntu2.2+esm3
Available with Ubuntu Pro
Ubuntu 14.04
-
krb5-user
-
1.12+dfsg-2ubuntu5.4+esm3
Available with Ubuntu Pro
-
libgssapi-krb5-2
-
1.12+dfsg-2ubuntu5.4+esm3
Available with Ubuntu Pro
-
krb5-kdc
-
1.12+dfsg-2ubuntu5.4+esm3
Available with Ubuntu Pro
-
libkdb5-7
-
1.12+dfsg-2ubuntu5.4+esm3
Available with Ubuntu Pro
-
krb5-admin-server
-
1.12+dfsg-2ubuntu5.4+esm3
Available with Ubuntu Pro
After a standard system update you need to restart any application
using Kerberos libraries to make all the necessary changes.
References
Related notices
- USN-5800-1: libkadm5clnt7-heimdal, libwind0-heimdal, heimdal-kcm, libhcrypto4-heimdal, heimdal-clients-x, libsl0-heimdal, libheimntlm0-heimdal, libroken18-heimdal, heimdal-dev, heimdal-clients, libhx509-5-heimdal, libasn1-8-heimdal, heimdal-docs, libheimbase1-heimdal, libkafs0-heimdal, libgssapi3-heimdal, heimdal-servers, heimdal-kdc, heimdal-servers-x, heimdal-multidev, libkrb5-26-heimdal, heimdal, libkdc2-heimdal, libkadm5srv8-heimdal, libhdb9-heimdal, libotp0-heimdal
- USN-5822-1: libwbclient-dev, libwbclient0, samba-vfs-modules, samba, python3-ldb-dev, libsmbclient, samba-dev, smbclient, winbind, python3-samba, samba-testsuite, python3-ldb, ldb-tools, samba-common, samba-dsdb-modules, samba-common-bin, libpam-winbind, samba-libs, libldb2, ctdb, registry-tools, libnss-winbind, libsmbclient-dev, libldb-dev
- USN-5936-1: libwbclient-dev, libwbclient0, samba-vfs-modules, samba, libsmbclient, samba-dev, smbclient, winbind, python3-samba, samba-testsuite, samba-dsdb-modules, samba-common-bin, samba-common, libpam-winbind, samba-libs, ctdb, registry-tools, libnss-winbind, libsmbclient-dev