[39632] in Kerberos
krb5-1.22.3 is released
daemon@ATHENA.MIT.EDU (Greg Hudson)
Mon Nov 9 12:07:31 2026
Message-ID: <54f6f840-8c9b-4bb0-8d65-6957229a439d@mit.edu>
Date: Mon, 9 Nov 2026 12:05:13 -0500
MIME-Version: 1.0
Content-Language: en-US
From: "Greg Hudson" <ghudson@mit.edu>
To: kerberos-announce@mit.edu
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="us-ascii"; Format="flowed"
Errors-To: kerberos-bounces@mit.edu
The MIT Kerberos Team announces the availability of MIT Kerberos 5
Release 1.22.3. Please see below for a list of some major changes
included, or consult the README file in the source tree for a more
detailed list of significant changes.
RETRIEVING KERBEROS 5 RELEASE 1.22.3
====================================
You may retrieve the Kerberos 5 Release 1.22.3 source from the
following URL:
https://kerberos.org/dist/
The homepage for the krb5-1.22.3 release is:
https://web.mit.edu/kerberos/krb5-1.23/
Further information about Kerberos 5 may be found at the following
URL:
https://web.mit.edu/kerberos/
and at the MIT Kerberos Consortium web site:
https://www.kerberos.org/
Major changes in 1.22.3 (2026-11-09)
====================================
This is a bug fix release, with a focus on security issues discovered
with the aid of large language models. See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.
* Fix a logic error when checking PAC server checksums
[CVE-2026-111423].
* Check for unkeyed checksums when validating CAMMAC verifiers
[CVE-2026-71199].
* Fix a loophole in the KDC's client authdata filtering which could
allow clients to include fake PAC and CAMMAC authdata values when
requesting service tickets. These fake values would be rejected by
application servers, were it not for the two bugs noted above.
* Check for the lockdown_keys attribute when processing password
change protocol requests in kadmind [CVE-2026-107884].
* In libgssrpc, when processing RPC messages using the RPCSEC_GSS
flavor, use the verified service type included in the RPC request to
determine how to unwrap arguments and wrap return values, instead of
the unverified service type included during authentication
[CVE-2026-118380].
* In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the
"GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set. AUTH_GSSAPI
is only needed for very old (pre-1.4) clients [CVE-2026-112322]
[CVE-2026-112323].
* Fix numerous null pointer deferences, read overruns, unbounded
memory allocations, and memory leaks that could be used as denial of
service attacks against the KDC, kadmind, application servers, or
client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200]
[CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778]
[CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316]
[CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319]
[CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323]
[CVE-2026-119079].
* Fix a client crash when a KKDCP proxy daemon closes the TLS session
without supplying any response data.
* Shut down kpropd gracefully when a termination signal is received,
when operating in incremental propagation mode.
* Detect when an incremental propagation update is applied to a
nonexistent principal; when this happens, force a full resync
instead of crashing.
* Fix a KDC crash when the LDAP KDB module loses its connection to the
LDAP server.
* Avoid a crash on macOS when the native API ccache type is used
before and after forking a process.
* When an application accepts a GSS context without asking for
delegated credentials, discard any credentials sent by the initiator
without parsing them first.
* On Windows, prevent buffer overflows when the KDC sends an
unexpectedly long prompt string via OTP preauthentication.
* On Windows, move the default per-machine krb5.ini location from
C:\ProgramData\MIT\Kerberos to C:\Program Files\MIT\Kerberos5, as
the former location could be pre-created by an unutrusted user
before KfW installation.
* On Windows, add error checking to kfwlogon to ensure that it does
not set ACLs on a cache file it did not create.
* On Windows, prevent several buffer overflows that could occur if an
application passes a large principal name to leashdll APIs.
* On Windows, prevent buffer overflows when the LSA cache contains
credentials with long principal name components.
_______________________________________________
kerberos-announce mailing list
kerberos-announce@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos-announce
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
