The fix mentioned in #8 is now in unapproved for both noble and jammy, I will remove the block tags once they enter proposed
** Description changed: [ Impact ] On Jammy and Noble, krb5 stores the time delta until password as a 32-bit signed integer, meaning that passwords expiring later than ~2100 (notably including the fake password expiry dates used by Windows Server 2025 AD) will print an erroneous password expiry warning of the highest urgency of 1 hour (since the overflowed negative delta is in fact sooner than one hour) This is fixed by backporting the upstream patch for this issue. [ Test Plan ] An autopkgtest (kinit_pwexpire) has been created alongside the patch to verify the fix. Its passing means the bug has been fixed. [ Where Problems Could Occur ] - As with any backport, this might introduce unexpected regressions which might require further SRUs with other upstream patches - This patch changes the time deltas to unsigned integers. The danger of *unsigned* overflow now exists if, say, a caller of ts_interval swaps the order of start and end time and wasn't adjusted with this patch + [ Other Info ] + + This package had a fix uploaded, and verification in the form of an + autopkgtest, but the test was erroneously set to run on 32 bit + architectures, which would always fail (because the relevant dates + aren't representable on those architectures at all). A second fix + disabling this fix was uploaded on top of the first. + [ Original Bug ] Versions of krb5 prior to 1.21 store the time delta until password expiry in a signed 32-bit integer, meaning they cannot represent times more than 2^31-1 seconds in the future, or about 68 years. Windows Server 2025's Active Directory uses a fake password expiry date in 2100 for accounts with no password expiry date, which is further in the future than that, and therefore this delta wraps around to being negative. This then counts as being less than 1 week, so it goes on to print a password expiry warning (opting for the "most pressing" one of 1 hour, since it is also less than 3600 seconds). This has been seen to occur on both Ubuntu 22.04 and Ubuntu 24.04, although the former is only by a colleague. The upstream bug fix for this is https://github.com/krb5/krb5/commit/29600cf1db888d91c42cbd6cf72652afe8c1ee66. Output appears as follows: waltham:~ jrtc4% kinit -l 365d Password for [email protected]: Warning: Your password will expire in less than one hour on Tue 14 Sep 2100 03:48:05 BST -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2162744 Title: kinit: Warns about password expiry for Windows Server 2025 DC To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2162744/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
