[17177] in Kerberos-V5-bugs
[krbdev.mit.edu #9228] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 11:56:59 2026
From: "Greg Hudson via RT" <rt-comment@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3124246-1794243413-1475.9228-4-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9228":;
Date: Mon, 09 Nov 2026 11:56:53 -0500
MIME-Version: 1.0
Reply-To: rt-comment@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
Mon Nov 09 11:56:53 2026: Request 9228 was acted upon.
Transaction: Ticket created by ghudson@mit.edu
Queue: krb5
Subject: git commit
Owner: ghudson@mit.edu
Requestors:
Status: new
Ticket <URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9228 >
Check for keyed checksums in CAMMAC verifiers
In libkrb5's check_svcver() and in the KDC's cammac_check_kdcver(),
return an error if the verifier uses an unkeyed checksum.
CVE-2026-71199:
In MIT krb5 release 1.14 and later (since authentication indicator
support was added), an authenticated attacker can bypass
authentication indicator requirements using an unkeyed checksum in the
CAMMAC authdata container. Discovered by Claude and Ada Logics, and
by Alejandro Pacheco.
https://github.com/krb5/krb5/commit/18142c9c3a3c2e16d8469aff342b02a28f0b468c
Author: Greg Hudson <ghudson@mit.edu>
Commit: 18142c9c3a3c2e16d8469aff342b02a28f0b468c
Branch: master
src/kdc/cammac.c | 2 +-
src/lib/krb5/krb/cammac_util.c | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
