Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package krb5 for openSUSE:Factory checked in at 2026-10-27 16:46:07 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/krb5 (Old) and /work/SRC/openSUSE:Factory/.krb5.new.2252680 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "krb5" Tue Oct 27 16:46:07 2026 rev:184 rq:1392615 version:1.22.2 Changes: -------- --- /work/SRC/openSUSE:Factory/krb5/krb5-mini.changes 2026-07-02 20:06:33.291361760 +0200 +++ /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5-mini.changes 2026-10-27 16:46:13.075583665 +0100 @@ -1,0 +2,9 @@ +Wed Oct 21 10:05:19 UTC 2026 - Noel Power <[email protected]> + +- Prevent denial of Service via crafted forwarded credentials + * CVE-2026-107778, bsc#1284816 +- Prevent denial of Service via malformed PAC in S4U2Proxy + * CVE-2026-107778, bsc#1284817 +- Add 0014-cve-2026-107708.patch and 0015-cve-2026-107778.patch + +------------------------------------------------------------------- krb5.changes: same change New: ---- 0014-cve-2026-107708.patch 0015-cve-2026-107778.patch ----------(New B)---------- New:/work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5-mini.changes- * CVE-2026-107778, bsc#1284817 /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5-mini.changes:- Add 0014-cve-2026-107708.patch and 0015-cve-2026-107778.patch /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5-mini.changes- -- /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5.changes- * CVE-2026-107778, bsc#1284817 /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5.changes:- Add 0014-cve-2026-107708.patch and 0015-cve-2026-107778.patch /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5.changes- New:/work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5-mini.changes- * CVE-2026-107778, bsc#1284817 /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5-mini.changes:- Add 0014-cve-2026-107708.patch and 0015-cve-2026-107778.patch /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5-mini.changes- -- /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5.changes- * CVE-2026-107778, bsc#1284817 /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5.changes:- Add 0014-cve-2026-107708.patch and 0015-cve-2026-107778.patch /work/SRC/openSUSE:Factory/.krb5.new.2252680/krb5.changes- ----------(New E)---------- ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ krb5-mini.spec ++++++ --- /var/tmp/diff_new_pack.BYxIzj/_old 2026-10-27 16:46:16.274717666 +0100 +++ /var/tmp/diff_new_pack.BYxIzj/_new 2026-10-27 16:46:16.277717791 +0100 @@ -50,6 +50,8 @@ Patch11: 0011-autoconf-2.73-compatibility.patch Patch12: 0012-Fix-two-NegoEx-parsing-vulnerabilities.patch Patch13: 0013-Prevent-read-overrun-in-libkdb_ldap.patch +Patch14: 0014-cve-2026-107708.patch +Patch15: 0015-cve-2026-107778.patch BuildRequires: autoconf BuildRequires: bison BuildRequires: pkgconfig krb5.spec: same change ++++++ 0014-cve-2026-107708.patch ++++++ >From f6e2c397ceda6467ebbaab8ed66d4895c9f1d6a7 Mon Sep 17 00:00:00 2001 From: TristanInSec <[email protected]> Date: Mon, 18 May 2026 11:56:34 -0400 Subject: [PATCH] Fix error handling in KDC PAC processing When get_pac_princ_with_realm() detects the wrong number of '@' characters, return an error instead of 0. When it encounters an error from krb5_parse_name_flags(), do not leak client_str. [[email protected]: fixed memory leak; rewrote commit message] ticket: 9212 (new) tags: pullup target_version: 1.22-next --- src/kdc/kdc_util.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c index 6f88afa2d..33b803fa9 100644 --- a/src/kdc/kdc_util.c +++ b/src/kdc/kdc_util.c @@ -665,13 +665,13 @@ get_pac_princ_with_realm(krb5_context context, krb5_pac pac, ret = krb5_parse_name_flags(context, client_str, flags, princ_out); if (ret) - return ret; + goto cleanup; (*princ_out)->type = KRB5_NT_MS_PRINCIPAL; cleanup: free(client_str); - return 0; + return ret; } /* This probably wants to be updated if you support last_req stuff */ -- 2.51.0 ++++++ 0015-cve-2026-107778.patch ++++++ >From 48afa9abb89ab2176bb20624d87d010b9984fc08 Mon Sep 17 00:00:00 2001 From: TristanInSec <[email protected]> Date: Mon, 18 May 2026 11:57:21 -0400 Subject: [PATCH] Avoid null dereference in krb5_rd_cred() A malformed KRB-CRED message may have fewer entries in the encrypted ticket-info list than it has in the tickets list. In each loop iteration, check if we unexpectedly reached the end of the ticket-info list to avoid a null dereference. [[email protected]: added comment; rewrote commit message] ticket: 9211 (new) tags: pullup target_version: 1.22-next --- src/lib/krb5/krb/rd_cred.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/src/lib/krb5/krb/rd_cred.c b/src/lib/krb5/krb/rd_cred.c index d89a98ae0..c341eba15 100644 --- a/src/lib/krb5/krb/rd_cred.c +++ b/src/lib/krb5/krb/rd_cred.c @@ -98,6 +98,11 @@ make_cred_list(krb5_context context, krb5_cred *krbcred, goto cleanup; info = encpart->ticket_info[i]; + if (info == NULL) { + /* We unexpectedly reached the end of the encrypted ticket info. */ + ret = KRB5KRB_AP_ERR_MODIFIED; + goto cleanup; + } ret = krb5_copy_principal(context, info->client, &list[i]->client); if (ret) goto cleanup; -- 2.51.0
