RHBA-2015:0429 - Bug Fix Advisory

Topic

Updated python-kerberos packages that fix one bug and add one enhancement are
now available for Red Hat Enterprise Linux 7.

Description

The python-kerberos packages contain a high-level wrapper for Kerberos Generic
Security Service Application Program Interface (GSSAPI) operations.

This update fixes the following bug:

• Prior to this update, the authenticate_gss_client_wrap() function

miscalculated the length of the "username" string when wrapping it.
Consequently, the Kerberos user name was not properly encoded into a GSSAPI
message, and the authentication failed. This patch fixes the calculation of the
"username" string length, and the authentication no longer fails. (BZ#1112373)

In addition, this update adds the following enhancement:

• The gss_inquire_cred() function now allows the user to obtain information

about current Generic Security Service (GSS) credentials without initiating
communication with a server. Previously, this was not possible even though this
feature was needed so that Identity Management could determine the current
Kerberos principal name. With this update, gss_inquire_cred() returns the
principal name of the current ticket granting ticket (TGT) file without sending
a request to the server. (BZ#1053860)

Users of python-kerberos are advised to upgrade to these updated packages, which
fix this bug and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux Server - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 1053860 - [RFE] add method to obtain current credentials
• BZ - 1112373 - authenticate_gss_client_wrap() fails to wrap username correctly

CVEs

(none)

References

(none)