[17211] in Kerberos-V5-bugs
[krbdev.mit.edu #9228] git commit
daemon@ATHENA.MIT.EDU (Greg Hudson via RT)
Mon Nov 9 12:01:01 2026
From: "Greg Hudson via RT" <rt@krbdev.mit.edu>
In-Reply-To:
Message-ID: <rt-4.4.3-2-3128769-1794243645-1033.9228-5-0@mit.edu>
To: "AdminCc of krbdev.mit.edu Ticket #9228":;
Date: Mon, 09 Nov 2026 12:00:45 -0500
MIME-Version: 1.0
Reply-To: rt@krbdev.mit.edu
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: krb5-bugs-bounces@mit.edu
<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=9228 >
Check for keyed checksums in CAMMAC verifiers
In libkrb5's check_svcver() and in the KDC's cammac_check_kdcver(),
return an error if the verifier uses an unkeyed checksum.
CVE-2026-71199:
In MIT krb5 release 1.14 and later (since authentication indicator
support was added), an authenticated attacker can bypass
authentication indicator requirements using an unkeyed checksum in the
CAMMAC authdata container. Discovered by Claude and Ada Logics, and
by Alejandro Pacheco.
(cherry picked from commit 18142c9c3a3c2e16d8469aff342b02a28f0b468c)
https://github.com/krb5/krb5/commit/d97f92d1afd8c44b84c43ef16eb3eb1d7ed879b4
Author: Greg Hudson <ghudson@mit.edu>
Commit: d97f92d1afd8c44b84c43ef16eb3eb1d7ed879b4
Branch: krb5-1.22
src/kdc/cammac.c | 2 +-
src/lib/krb5/krb/cammac_util.c | 2 ++
2 files changed, 3 insertions(+), 1 deletion(-)
_______________________________________________
krb5-bugs mailing list
krb5-bugs@mit.edu
https://mailman.mit.edu/mailman/listinfo/krb5-bugs
