Alerts This Week
Warning Icon 1 916
Alerts This Week
Warning Icon 1 916

Red Hat 9 RHSA-2023-2570-01 Moderate: Kerberos Delegation Bypass

red hat
Calendar Grey May 9, 2023
Dist Redhat Esm H88
A measured security notice for Red Hat's krb5 revision tackling a possible workaround in delegation limitations.
An update for krb5 is now available for Red Hat Enterprise Linux 9

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, running Kerberos services (krb5kdc, kadmin, and kprop) will be restarted automatically.

Summary

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).
The following packages have been upgraded to a later upstream version: krb5 (1.20.1). (BZ#2016312)
Security Fix(es):
* Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section.

Topics%20covered

Topics Covered

security advisory Red Hat security fix moderate impact krb5 update network authentication delegation bypass

References

https://access.redhat.com/security/cve/CVE-2020-17049 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index

Package List

Red Hat Enterprise Linux AppStream (v. 9):
aarch64: krb5-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-debugsource-1.20.1-8.el9.aarch64.rpm krb5-devel-1.20.1-8.el9.aarch64.rpm krb5-libs-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-server-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-workstation-debuginfo-1.20.1-8.el9.aarch64.rpm libkadm5-debuginfo-1.20.1-8.el9.aarch64.rpm
ppc64le: krb5-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-debugsource-1.20.1-8.el9.ppc64le.rpm krb5-devel-1.20.1-8.el9.ppc64le.rpm krb5-libs-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-server-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-workstation-debuginfo-1.20.1-8.el9.ppc64le.rpm libkadm5-debuginfo-1.20.1-8.el9.ppc64le.rpm
s390x: krb5-debuginfo-1.20.1-8.el9.s390x.rpm krb5-debugsource-1.20.1-8.el9.s390x.rpm krb5-devel-1.20.1-8.el9.s390x.rpm krb5-libs-debuginfo-1.20.1-8.el9.s390x.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.s390x.rpm krb5-server-debuginfo-1.20.1-8.el9.s390x.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.s390x.rpm krb5-workstation-debuginfo-1.20.1-8.el9.s390x.rpm libkadm5-debuginfo-1.20.1-8.el9.s390x.rpm
x86_64:

Read the Full Advisory


Advisory ID: RHSA-2023:2570-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2023:2570
Issue date: 2023-05-09

Topic

An update for krb5 is now available for Red Hat Enterprise Linux 9.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.

Topics%20covered

Topics Covered

security advisory Red Hat security fix moderate impact krb5 update network authentication delegation bypass

Relevant Releases Architectures

Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64

Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, ppc64le, s390x, x86_64

Bugs Fixed

1956994 - CVE-2020-17049 krb5: Kerberos: delegation constrain bypass in S4U2Proxy [rhel-9]

2016312 - Rebase krb5 to latest upstream release 1.20 [rhel-9]

2025721 - CVE-2020-17049 Kerberos: delegation constrain bypass in S4U2Proxy

2063838 - Mishandling of CMS_verify() errors in PKINIT plugin

2068535 - Modify supported_enctypes (kdc.conf) and add aes256/128-sha2 enctypes due to FIPS

2121099 - Incorrect password expiration handling [rhel-9]

2151513 - upstream test t_discover_uri.py failed [rhel-9.2]

2159643 - Cannot set root as file owner using install in Mock build environment

2162461 - creating of user principal failed with Cryptosystem internal error when the aes256-cts is used (FIPS)

2165827 - CVE-2022-37967: MS-PAC extended KDC signature [rhel-9]

2166603 - KDB: double free in kdb5_create.c:add_principal()

2169985 - add krb5 principal failed with specific datetime string in pwexpire option (s390x, coredump)

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here