Ubuntu 5828-1: Kerberos vulnerabilities | LinuxSecurity.com
==========================================================================
Ubuntu Security Notice USN-5828-1
January 25, 2023

krb5 vulnerabilities
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 LTS
- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM

Summary:

Several security issues were fixed in Kerberos.

Software Description:
- krb5: MIT Kerberos Network Authentication Protocol

Details:

It was discovered that Kerberos incorrectly handled certain S4U2Self
requests. An attacker could possibly use this issue to cause a denial of
service. This issue was only addressed in Ubuntu 16.04 ESM and Ubuntu
18.04 LTS. (CVE-2018-20217)

Greg Hudson discovered that Kerberos PAC implementation incorrectly
handled certain parsing operations. A remote attacker could use this
issue to cause a denial of service, or possibly execute arbitrary code.
(CVE-2022-42898)

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.10:
   krb5-admin-server               1.20-1ubuntu0.1
   krb5-kdc                        1.20-1ubuntu0.1
   krb5-user                       1.20-1ubuntu0.1
   libgssapi-krb5-2                1.20-1ubuntu0.1
   libkdb5-10                      1.20-1ubuntu0.1

Ubuntu 22.04 LTS:
   krb5-admin-server               1.19.2-2ubuntu0.1
   krb5-kdc                        1.19.2-2ubuntu0.1
   krb5-user                       1.19.2-2ubuntu0.1
   libgssapi-krb5-2                1.19.2-2ubuntu0.1
   libkdb5-10                      1.19.2-2ubuntu0.1

Ubuntu 20.04 LTS:
   krb5-admin-server               1.17-6ubuntu4.2
   krb5-kdc                        1.17-6ubuntu4.2
   krb5-user                       1.17-6ubuntu4.2
   libgssapi-krb5-2                1.17-6ubuntu4.2
   libkdb5-9                       1.17-6ubuntu4.2

Ubuntu 18.04 LTS:
   krb5-admin-server               1.16-2ubuntu0.3
   krb5-kdc                        1.16-2ubuntu0.3
   krb5-user                       1.16-2ubuntu0.3
   libgssapi-krb5-2                1.16-2ubuntu0.3
   libkdb5-9                       1.16-2ubuntu0.3

Ubuntu 16.04 ESM:
   krb5-admin-server               1.13.2+dfsg-5ubuntu2.2+esm3
   krb5-kdc                        1.13.2+dfsg-5ubuntu2.2+esm3
   krb5-user                       1.13.2+dfsg-5ubuntu2.2+esm3
   libgssapi-krb5-2                1.13.2+dfsg-5ubuntu2.2+esm3
   libkdb5-8                       1.13.2+dfsg-5ubuntu2.2+esm3

Ubuntu 14.04 ESM:
   krb5-admin-server               1.12+dfsg-2ubuntu5.4+esm3
   krb5-kdc                        1.12+dfsg-2ubuntu5.4+esm3
   krb5-user                       1.12+dfsg-2ubuntu5.4+esm3
   libgssapi-krb5-2                1.12+dfsg-2ubuntu5.4+esm3
   libkdb5-7                       1.12+dfsg-2ubuntu5.4+esm3

After a standard system update you need to restart any application
using Kerberos libraries to make all the necessary changes.

References:
   https://ubuntu.com/security/notices/USN-5828-1
   CVE-2018-20217, CVE-2022-42898

Package Information:
   https://launchpad.net/ubuntu/+source/krb5/1.20-1ubuntu0.1
   https://launchpad.net/ubuntu/+source/krb5/1.19.2-2ubuntu0.1
   https://launchpad.net/ubuntu/+source/krb5/1.17-6ubuntu4.2
   https://launchpad.net/ubuntu/+source/krb5/1.16-2ubuntu0.3

Ubuntu 5828-1: Kerberos vulnerabilities

January 25, 2023
Several security issues were fixed in Kerberos.

Summary

A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 22.10 - Ubuntu 22.04 LTS - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: Several security issues were fixed in Kerberos. Software Description: - krb5: MIT Kerberos Network Authentication Protocol Details: It was discovered that Kerberos incorrectly handled certain S4U2Self requests. An attacker could possibly use this issue to cause a denial of service. This issue was only addressed in Ubuntu 16.04 ESM and Ubuntu 18.04 LTS. (CVE-2018-20217) Greg Hudson discovered that Kerberos PAC implementation incorrectly handled certain parsing operations. A remote attacker could use this issue to cause a denial of service, or possibly execute arbitrary code. (CVE-2022-42898)

Update Instructions

The problem can be corrected by updating your system to the following package versions: Ubuntu 22.10: krb5-admin-server 1.20-1ubuntu0.1 krb5-kdc 1.20-1ubuntu0.1 krb5-user 1.20-1ubuntu0.1 libgssapi-krb5-2 1.20-1ubuntu0.1 libkdb5-10 1.20-1ubuntu0.1 Ubuntu 22.04 LTS: krb5-admin-server 1.19.2-2ubuntu0.1 krb5-kdc 1.19.2-2ubuntu0.1 krb5-user 1.19.2-2ubuntu0.1 libgssapi-krb5-2 1.19.2-2ubuntu0.1 libkdb5-10 1.19.2-2ubuntu0.1 Ubuntu 20.04 LTS: krb5-admin-server 1.17-6ubuntu4.2 krb5-kdc 1.17-6ubuntu4.2 krb5-user 1.17-6ubuntu4.2 libgssapi-krb5-2 1.17-6ubuntu4.2 libkdb5-9 1.17-6ubuntu4.2 Ubuntu 18.04 LTS: krb5-admin-server 1.16-2ubuntu0.3 krb5-kdc 1.16-2ubuntu0.3 krb5-user 1.16-2ubuntu0.3 libgssapi-krb5-2 1.16-2ubuntu0.3 libkdb5-9 1.16-2ubuntu0.3 Ubuntu 16.04 ESM: krb5-admin-server 1.13.2+dfsg-5ubuntu2.2+esm3 krb5-kdc 1.13.2+dfsg-5ubuntu2.2+esm3 krb5-user 1.13.2+dfsg-5ubuntu2.2+esm3 libgssapi-krb5-2 1.13.2+dfsg-5ubuntu2.2+esm3 libkdb5-8 1.13.2+dfsg-5ubuntu2.2+esm3 Ubuntu 14.04 ESM: krb5-admin-server 1.12+dfsg-2ubuntu5.4+esm3 krb5-kdc 1.12+dfsg-2ubuntu5.4+esm3 krb5-user 1.12+dfsg-2ubuntu5.4+esm3 libgssapi-krb5-2 1.12+dfsg-2ubuntu5.4+esm3 libkdb5-7 1.12+dfsg-2ubuntu5.4+esm3 After a standard system update you need to restart any application using Kerberos libraries to make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-5828-1

CVE-2018-20217, CVE-2022-42898

Severity
Ubuntu Security Notice USN-5828-1

Package Information

https://launchpad.net/ubuntu/+source/krb5/1.20-1ubuntu0.1 https://launchpad.net/ubuntu/+source/krb5/1.19.2-2ubuntu0.1 https://launchpad.net/ubuntu/+source/krb5/1.17-6ubuntu4.2 https://launchpad.net/ubuntu/+source/krb5/1.16-2ubuntu0.3

We use cookies to provide and improve our services. By using our site, you consent to our Cookie Policy.