Stay Secure with the Latest Linux Advisories

security advisoryRed Hatsecurity fix

Red Hat 9 RHSA-2023-2570-01 Moderate: Kerberos Delegation Bypass

An update for krb5 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: krb5 security, bug fix, and enhancement update Advisory ID: RHSA-2023:2570-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2023:2570 Issue date: 2023-05-09 CVE Names: CVE-2020-17049 ==================================================================== 1. Summary: An update for krb5 is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 9) - aarch64, ppc64le, s390x, x86_64 Red Hat Enterprise Linux BaseOS (v. 9) - aarch64, ppc64le, s390x, x86_64 3. Description: Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC). The following packages have been upgraded to a later upstream version: krb5 (1.20.1). (BZ#2016312) Security Fix(es): * Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to theCVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.2 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 After installing the updated packages, running Kerberos services (krb5kdc, kadmin, and kprop) will be restarted automatically. 5. Bugs fixed (https://bugzilla.redhat.com/): 1956994 - CVE-2020-17049 krb5: Kerberos: delegation constrain bypass in S4U2Proxy [rhel-9] 2016312 - Rebase krb5 to latest upstream release 1.20 [rhel-9] 2025721 - CVE-2020-17049 Kerberos: delegation constrain bypass in S4U2Proxy 2063838 - Mishandling of CMS_verify() errors in PKINIT plugin 2068535 - Modify supported_enctypes (kdc.conf) and add aes256/128-sha2 enctypes due to FIPS 2121099 - Incorrect password expiration handling [rhel-9] 2151513 - upstream test t_discover_uri.py failed [rhel-9.2] 2159643 - Cannot set root as file owner using install in Mock build environment 2162461 - creating of user principal failed with Cryptosystem internal error when the aes256-cts is used (FIPS) 2165827 - CVE-2022-37967: MS-PAC extended KDC signature [rhel-9] 2166603 - KDB: double free in kdb5_create.c:add_principal() 2169985 - add krb5 principal failed with specific datetime string in pwexpire option (s390x, coredump) 6. Package List: Red Hat Enterprise Linux AppStream (v.9): aarch64: krb5-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-debugsource-1.20.1-8.el9.aarch64.rpm krb5-devel-1.20.1-8.el9.aarch64.rpm krb5-libs-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-server-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-workstation-debuginfo-1.20.1-8.el9.aarch64.rpm libkadm5-debuginfo-1.20.1-8.el9.aarch64.rpm ppc64le: krb5-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-debugsource-1.20.1-8.el9.ppc64le.rpm krb5-devel-1.20.1-8.el9.ppc64le.rpm krb5-libs-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-server-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-workstation-debuginfo-1.20.1-8.el9.ppc64le.rpm libkadm5-debuginfo-1.20.1-8.el9.ppc64le.rpm s390x: krb5-debuginfo-1.20.1-8.el9.s390x.rpm krb5-debugsource-1.20.1-8.el9.s390x.rpm krb5-devel-1.20.1-8.el9.s390x.rpm krb5-libs-debuginfo-1.20.1-8.el9.s390x.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.s390x.rpm krb5-server-debuginfo-1.20.1-8.el9.s390x.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.s390x.rpm krb5-workstation-debuginfo-1.20.1-8.el9.s390x.rpm libkadm5-debuginfo-1.20.1-8.el9.s390x.rpm x86_64: krb5-debuginfo-1.20.1-8.el9.i686.rpm krb5-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-debugsource-1.20.1-8.el9.i686.rpm krb5-debugsource-1.20.1-8.el9.x86_64.rpm krb5-devel-1.20.1-8.el9.i686.rpm krb5-devel-1.20.1-8.el9.x86_64.rpm krb5-libs-debuginfo-1.20.1-8.el9.i686.rpm krb5-libs-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.i686.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-server-debuginfo-1.20.1-8.el9.i686.rpm krb5-server-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.i686.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-workstation-debuginfo-1.20.1-8.el9.i686.rpm krb5-workstation-debuginfo-1.20.1-8.el9.x86_64.rpm libkadm5-debuginfo-1.20.1-8.el9.i686.rpm libkadm5-debuginfo-1.20.1-8.el9.x86_64.rpm Red Hat Enterprise Linux BaseOS(v.9): Source: krb5-1.20.1-8.el9.src.rpm aarch64: krb5-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-debugsource-1.20.1-8.el9.aarch64.rpm krb5-libs-1.20.1-8.el9.aarch64.rpm krb5-libs-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-pkinit-1.20.1-8.el9.aarch64.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-server-1.20.1-8.el9.aarch64.rpm krb5-server-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-server-ldap-1.20.1-8.el9.aarch64.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.aarch64.rpm krb5-workstation-1.20.1-8.el9.aarch64.rpm krb5-workstation-debuginfo-1.20.1-8.el9.aarch64.rpm libkadm5-1.20.1-8.el9.aarch64.rpm libkadm5-debuginfo-1.20.1-8.el9.aarch64.rpm ppc64le: krb5-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-debugsource-1.20.1-8.el9.ppc64le.rpm krb5-libs-1.20.1-8.el9.ppc64le.rpm krb5-libs-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-pkinit-1.20.1-8.el9.ppc64le.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-server-1.20.1-8.el9.ppc64le.rpm krb5-server-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-server-ldap-1.20.1-8.el9.ppc64le.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.ppc64le.rpm krb5-workstation-1.20.1-8.el9.ppc64le.rpm krb5-workstation-debuginfo-1.20.1-8.el9.ppc64le.rpm libkadm5-1.20.1-8.el9.ppc64le.rpm libkadm5-debuginfo-1.20.1-8.el9.ppc64le.rpm s390x: krb5-debuginfo-1.20.1-8.el9.s390x.rpm krb5-debugsource-1.20.1-8.el9.s390x.rpm krb5-libs-1.20.1-8.el9.s390x.rpm krb5-libs-debuginfo-1.20.1-8.el9.s390x.rpm krb5-pkinit-1.20.1-8.el9.s390x.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.s390x.rpm krb5-server-1.20.1-8.el9.s390x.rpm krb5-server-debuginfo-1.20.1-8.el9.s390x.rpm krb5-server-ldap-1.20.1-8.el9.s390x.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.s390x.rpm krb5-workstation-1.20.1-8.el9.s390x.rpm krb5-workstation-debuginfo-1.20.1-8.el9.s390x.rpm libkadm5-1.20.1-8.el9.s390x.rpm libkadm5-debuginfo-1.20.1-8.el9.s390x.rpm x86_64: krb5-debuginfo-1.20.1-8.el9.i686.rpm krb5-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-debugsource-1.20.1-8.el9.i686.rpm krb5-debugsource-1.20.1-8.el9.x86_64.rpm krb5-libs-1.20.1-8.el9.i686.rpm krb5-libs-1.20.1-8.el9.x86_64.rpm krb5-libs-debuginfo-1.20.1-8.el9.i686.rpm krb5-libs-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-pkinit-1.20.1-8.el9.i686.rpm krb5-pkinit-1.20.1-8.el9.x86_64.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.i686.rpm krb5-pkinit-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-server-1.20.1-8.el9.i686.rpm krb5-server-1.20.1-8.el9.x86_64.rpm krb5-server-debuginfo-1.20.1-8.el9.i686.rpm krb5-server-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-server-ldap-1.20.1-8.el9.i686.rpm krb5-server-ldap-1.20.1-8.el9.x86_64.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.i686.rpm krb5-server-ldap-debuginfo-1.20.1-8.el9.x86_64.rpm krb5-workstation-1.20.1-8.el9.x86_64.rpm krb5-workstation-debuginfo-1.20.1-8.el9.i686.rpm krb5-workstation-debuginfo-1.20.1-8.el9.x86_64.rpm libkadm5-1.20.1-8.el9.i686.rpm libkadm5-1.20.1-8.el9.x86_64.rpm libkadm5-debuginfo-1.20.1-8.el9.i686.rpm libkadm5-debuginfo-1.20.1-8.el9.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2020-17049 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/9/html/9.2_release_notes/index 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2023 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPGv1 iQIVAwUBZFo18tzjgjWX9erEAQhKwRAAgVNswDfJwf66bbkVlkMJkkE/weDgePKI nIpK7ThNNtRBBGupipzwcCLdgLOgAXCZsBQ8YZEFnkWKdwVRMZu6aYmjHQ9R9b8U XYqBvaStpLgkJ5PlmtOwDmGkruGJL9VvLAfx6NxhqaM+Bpcbd466aKbgDb/VCirk sKv5MOGujlVnrQ/LfTrLg/fbq0se484e6g9OLa+XFxnAe9ig8WaJ2dOe5gr48LUo znz4SSXNGnQusJLGUzbsm4JdxH289Z1NWBKLmyrIOxxlkuW2AAcKsYSG1gQQRX9i 3hMQ9vCozDOnq+RYJMc4txiL0q2iL3g5zwGVRkBGuHgIiNXZaJFz3SAQRCS98mpW auFpkNnMKiYad+tlavHsPUH/jpWr1qZC5EBfAI58Wq9bKx9fanFqxKGGSEy9EFpx nhjx5FlpEjD8NcOLsLm6BmMkXyecmPBuqFCSUByGJXRyuLQUCDqky8U0kYt2/ZnQ CsXS2VP5FNMLVQcSmGBwMJnWC1OP4vvGGrsQiFkMBkSooEjiS8ImUhqSAnKNSqHJ myMJd3p6Jmdy1A81PdifJGeo72O+9Z11D5Jiwxb0Pp1bYmNUN5ye6v5qMUxc1E5W Li2m1kieLNJEGsWZPeDqwKiTwLlOn/gM3ed5eohRl9TUBHt3dRo8xWQ9+CKLgyaH mtg6CsZwd+Y=CtK8 -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . A measured security notice for Red Hat's krb5 revision tackling a possible workaround in delegation limitations.. RedHat Security, krb5 Update, Moderate Threat, Bug Fix, Network Authentication. . LinuxSecurity.com Team

May 09, 2023 Red Hat