Issued:
2021-05-18
Updated:
2021-05-18

RHSA-2021:1593 - Security Advisory

Synopsis

Moderate: krb5 security update

Type/Severity

Security Advisory: Moderate

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for krb5 is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

  • krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS (CVE-2020-28196)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.4 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

After installing the updated packages, running Kerberos services (krb5kdc, kadmin, and kprop) will be restarted automatically.

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 1835713 - krb5: typo error(s) in man page(s)
  • BZ - 1868039 - krb5 spec file - wrong url in source0 and source1
  • BZ - 1869055 - [doc] kvno usage not compliant with man page kvno(1)
  • BZ - 1872689 - Radius Authentication does not work in FIPS mode
  • BZ - 1901041 - CVE-2020-28196 krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS

Red Hat Enterprise Linux for x86_64 8

SRPM
krb5-1.18.2-8.el8.src.rpm SHA-256: 2f410ad1a755ec2d4b84e4e06308b0aa6d96a15f87470f3353c78dff1f705552
x86_64
krb5-debuginfo-1.18.2-8.el8.i686.rpm SHA-256: bb8a31c6c6ea8905aa1a7bc72d5d4b5bb3391e3d47afe23ffca56643296a398f
krb5-debuginfo-1.18.2-8.el8.x86_64.rpm SHA-256: 4b56cbf831acaba7ebcaf81e74820f7fa47d50083992910f2fc8079f8817b9ea
krb5-debugsource-1.18.2-8.el8.i686.rpm SHA-256: 6dcdd252aba3cb4ad67bbbe4da33bb9b318d47ba4d93a733e1962aff1fab3d4f
krb5-debugsource-1.18.2-8.el8.x86_64.rpm SHA-256: 5d604e2e88b86a7406ba9eccfd000b8163f6b9946a242436c18921c0a1f2b339
krb5-devel-1.18.2-8.el8.i686.rpm SHA-256: 395ba46a1c1608e3b8b2bb0e3fe20daa5940cddb33a5b5c0a426f40ae27b26a9
krb5-devel-1.18.2-8.el8.x86_64.rpm SHA-256: f7a941d329976732305f237cfa3f9903169630fd6b42d746f50fef646ac41530
krb5-devel-debuginfo-1.18.2-8.el8.i686.rpm SHA-256: 4eba04bcd89f9313a2f80f4b34c1874b68fafd407022c43b8455aa3c850647b5
krb5-devel-debuginfo-1.18.2-8.el8.x86_64.rpm SHA-256: c3262f8217d033d8490817835143a37c3ede0a21690569bb90fb656e8de6d80b
krb5-libs-1.18.2-8.el8.i686.rpm SHA-256: 039ce1b3d00a5275f5f886f925a24caef868e872f6486ff2c5b5faf65dfa4b26
krb5-libs-1.18.2-8.el8.x86_64.rpm SHA-256: c79d94c1289135a659a54a2328f40b5739db9afc969d5fa601db67f4e07ffcfe
krb5-libs-debuginfo-1.18.2-8.el8.i686.rpm SHA-256: d074231c1ea2cf09088b920835346d22fbc787088d51ace3aa2afdfcb7bae020
krb5-libs-debuginfo-1.18.2-8.el8.x86_64.rpm SHA-256: f011eb8c1a289a9604ff1b4628144ca85712e6aae1980f0bbce67380a9c6f808
krb5-pkinit-1.18.2-8.el8.i686.rpm SHA-256: 7000af76efb74d39f704ff31a1222b0d850355bbc69adebad34c477f46c56504
krb5-pkinit-1.18.2-8.el8.x86_64.rpm SHA-256: ef5fa7f4313ded7d8c903d6ded8f1bd2ca4163ca5175e22905a8048755cb76d5
krb5-pkinit-debuginfo-1.18.2-8.el8.i686.rpm SHA-256: 19b1e8c980435491d969f12b53314da25c9fa206654034064e6fb5598030c2fe
krb5-pkinit-debuginfo-1.18.2-8.el8.x86_64.rpm SHA-256: 9778d2f3f7ac342dcd31c851137071902d2ab000ce0e54c1eed5b5ced10ea2fe
krb5-server-1.18.2-8.el8.i686.rpm SHA-256: 033f0fc22fb7a38e9248894a9c064950d48ef432cfc91032faafe6f1e5225410
krb5-server-1.18.2-8.el8.x86_64.rpm SHA-256: 1d07f18a5f382ccb8ca9eb91c4501f0ac338e3c92930fe2c2466a6521cf68d8b
krb5-server-debuginfo-1.18.2-8.el8.i686.rpm SHA-256: d7d710b4ca8923d44b8e38e68b6f0a114d71696e336a92f40c76bdd4892450e7
krb5-server-debuginfo-1.18.2-8.el8.x86_64.rpm SHA-256: 5f737ab7332a338705e00670209c2df73f63bae71360eaaa22c9bb4f15e5e5bd
krb5-server-ldap-1.18.2-8.el8.i686.rpm SHA-256: 594e0fd6326fc149b709143fad2db33acd9f519c08a15b5e09ba2bed38a1930e
krb5-server-ldap-1.18.2-8.el8.x86_64.rpm SHA-256: 81711e70becaf53022f93790ee31ef431fbbafdda3261ca9ec092c9d7b8a870c
krb5-server-ldap-debuginfo-1.18.2-8.el8.i686.rpm SHA-256: da704919e6b8e5921a6b3dc829a7ffcc11cb6f87ef2d7237c272fa2e8d617bb2
krb5-server-ldap-debuginfo-1.18.2-8.el8.x86_64.rpm SHA-256: 4c2d12be055b7bc39fd09d5eb706cf154466886ded417066a717941699afa62e
krb5-workstation-1.18.2-8.el8.x86_64.rpm SHA-256: cffb2686bc65b4e4f1c5ca98dca9941e85d14e6e2308b85a69bd52c8ae0f377f
krb5-workstation-debuginfo-1.18.2-8.el8.i686.rpm SHA-256: 7adcf802c9f752512473323b3ef2ce4b4651b4946c3767aaa1cca34dd73d5153
krb5-workstation-debuginfo-1.18.2-8.el8.x86_64.rpm SHA-256: a1685468ac34061e3674b381b4bd4e62b790134c7776ed16173b082cd79aa131
libkadm5-1.18.2-8.el8.i686.rpm SHA-256: 2beae1d23f9faa57df8e8988f0c8af8e594075e8e07a758b8155947bb800c0f8
libkadm5-1.18.2-8.el8.x86_64.rpm SHA-256: f177edb54a625c73b695fad2d8062ad45aeedc2be57585030d962707329ad102
libkadm5-debuginfo-1.18.2-8.el8.i686.rpm SHA-256: 90eb57d5eaed2288a7205d665aff10335d379d26c452c031d77564bce0e5dc83
libkadm5-debuginfo-1.18.2-8.el8.x86_64.rpm SHA-256: ca55b26c502dacb2e6fd1fe1ebc1bb0ff024bfe18c17dafbde751723fa12981e

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
krb5-1.18.2-8.el8.src.rpm SHA-256: 2f410ad1a755ec2d4b84e4e06308b0aa6d96a15f87470f3353c78dff1f705552
s390x
krb5-debuginfo-1.18.2-8.el8.s390x.rpm SHA-256: 941704b413d2f604db7c9f0bae602e538bcbe4eee178a7bdccdef565b1881104
krb5-debugsource-1.18.2-8.el8.s390x.rpm SHA-256: 22cf256032a1b31655823605bacf8fb88f1ffe855a370f0ec6051d13e80def22
krb5-devel-1.18.2-8.el8.s390x.rpm SHA-256: 62c7a6281972d48e4639258853d034c5ca2f016a786f4dab47f489cd2f653b9d
krb5-devel-debuginfo-1.18.2-8.el8.s390x.rpm SHA-256: 577e3f1c76f937912369a75f56d6fffed78774205384df8f4ee82e5b45c104a9
krb5-libs-1.18.2-8.el8.s390x.rpm SHA-256: 0bf3cc8201582598c572248653d49d316e150156f75a49bf961a93578ce6eb40
krb5-libs-debuginfo-1.18.2-8.el8.s390x.rpm SHA-256: 30d032621dc38799fe46ab0c541454d701bebe5bd5109876ca4597190ad58c6a
krb5-pkinit-1.18.2-8.el8.s390x.rpm SHA-256: 776556a0f5033c39e0b325c99c60188f0c6b85e09ab9ebc8f404fcd27bb32381
krb5-pkinit-debuginfo-1.18.2-8.el8.s390x.rpm SHA-256: 4286eacfc8e245ff1e76c7110e35dfa40d85bfa1a342ab59efbacb6529e6a467
krb5-server-1.18.2-8.el8.s390x.rpm SHA-256: f5ea48250c6f4f23c055d34d51ccfe1ea22f072c72e2c00e82388b76ee4ecc4a
krb5-server-debuginfo-1.18.2-8.el8.s390x.rpm SHA-256: b41c536725dba1200abc612e1ceb11f44be66dd6102fe6860034c35a9c407de6
krb5-server-ldap-1.18.2-8.el8.s390x.rpm SHA-256: 2cda209b22bd4a7d6c39bff76fca37c3f0f2dfc6cda741b6a9b3d4b5a8ff9398
krb5-server-ldap-debuginfo-1.18.2-8.el8.s390x.rpm SHA-256: 16855241c4df9a8dacd4fae12e7eec76bb9984ac32873f8fd6edf661bf0c09db
krb5-workstation-1.18.2-8.el8.s390x.rpm SHA-256: e6eee03c6e1de22ef8791597cade824f1151a24076c549383b90c3d765307127
krb5-workstation-debuginfo-1.18.2-8.el8.s390x.rpm SHA-256: 423c21aaa94ddeddbbf6b907883e38a6ee4462f53444809ea77f67ca09ebb881
libkadm5-1.18.2-8.el8.s390x.rpm SHA-256: db0dc7ad2d5608b569de96bf71451ac194f3b91a5efabc240ecfcd6cd6d7bd31
libkadm5-debuginfo-1.18.2-8.el8.s390x.rpm SHA-256: 70884849be060980a79c5294d229ce63e49cb376b9818f59bd004e52c7c74a40

Red Hat Enterprise Linux for Power, little endian 8

SRPM
krb5-1.18.2-8.el8.src.rpm SHA-256: 2f410ad1a755ec2d4b84e4e06308b0aa6d96a15f87470f3353c78dff1f705552
ppc64le
krb5-debuginfo-1.18.2-8.el8.ppc64le.rpm SHA-256: 6f09049487fab480b3b62a5d00bc2eb9abbea152c26bf474de417b7b060950b7
krb5-debugsource-1.18.2-8.el8.ppc64le.rpm SHA-256: 7637c3fd6b9b5648772eddf226ad39ff8f5a4170f84ce167607a5b6180e461cc
krb5-devel-1.18.2-8.el8.ppc64le.rpm SHA-256: 9f757ae65a863146bf46d08ad40577f92792f010525212821efe9add76315dbb
krb5-devel-debuginfo-1.18.2-8.el8.ppc64le.rpm SHA-256: 1b41fe43eedbb7348dd965ffdb8fd3eee7dbdb30c4bb87b1cba1b9b268e9c033
krb5-libs-1.18.2-8.el8.ppc64le.rpm SHA-256: 3f53059f4d90f6d28bd78ea54a6069bfa53d44bd90ccf95af7c000fd4b411b2a
krb5-libs-debuginfo-1.18.2-8.el8.ppc64le.rpm SHA-256: bd6e0b16f331c7cb4c743f94bb615426ef56d56e8a7c6bc09d68f98cd7f19f49
krb5-pkinit-1.18.2-8.el8.ppc64le.rpm SHA-256: 7af35a2e5f426fb370f9f1590a86b1aea7fd60d5c83a7617de24962edc46ba86
krb5-pkinit-debuginfo-1.18.2-8.el8.ppc64le.rpm SHA-256: fcbc4f90dd63c4ae594df8a8f5b7d427877f7c0d0324beccfc064206a7477804
krb5-server-1.18.2-8.el8.ppc64le.rpm SHA-256: 9c6ffe3e1c0d40dc1f86e8ef9928a9c8951de4874b73c155d32de19068fc6970
krb5-server-debuginfo-1.18.2-8.el8.ppc64le.rpm SHA-256: 6ff7e0736ded5e63cb565d188a2647cf331173d26fb759d92abfa336324fdfe6
krb5-server-ldap-1.18.2-8.el8.ppc64le.rpm SHA-256: 1c34f41b084990159853b83c68f94ed96682883e8bb56cc4d3c52a19289dd0cc
krb5-server-ldap-debuginfo-1.18.2-8.el8.ppc64le.rpm SHA-256: 019fae0fd5a8e9deb1c36d7724989e36526ef9564db3a18e99dbdd03a231c637
krb5-workstation-1.18.2-8.el8.ppc64le.rpm SHA-256: bb3217146bd59ecbc611d952ada63d6cbcc7ece5c5c53522b73081a0ae1ad429
krb5-workstation-debuginfo-1.18.2-8.el8.ppc64le.rpm SHA-256: e8a60dbb21e4c2daa01558126d901138601b2eae3cca1b58eef0d35a72975cc9
libkadm5-1.18.2-8.el8.ppc64le.rpm SHA-256: c3b0634bbe62d435b7c84ba8458fb6e7e3695caf0fa61fecf5891bf3a2cea703
libkadm5-debuginfo-1.18.2-8.el8.ppc64le.rpm SHA-256: a84cdaa85c0ae2e2aa56026f1b8231f00e6595492ab95d83aa69d7024340eefd

Red Hat Enterprise Linux for ARM 64 8

SRPM
krb5-1.18.2-8.el8.src.rpm SHA-256: 2f410ad1a755ec2d4b84e4e06308b0aa6d96a15f87470f3353c78dff1f705552
aarch64
krb5-debuginfo-1.18.2-8.el8.aarch64.rpm SHA-256: c4ea44ffcd499cfff8a51a241c7f224f3bf03ddff49f30906397c087bb86f5c7
krb5-debugsource-1.18.2-8.el8.aarch64.rpm SHA-256: 69901a449d0da25812997a4b59992cc3a542c9e5d83e987cbebbf02378c447ae
krb5-devel-1.18.2-8.el8.aarch64.rpm SHA-256: b04a0c3c796942c78988440f6b49119926bb306a82debcf4c6699dddf35b5bc5
krb5-devel-debuginfo-1.18.2-8.el8.aarch64.rpm SHA-256: 7d47eaaf8773025ce8af304b78a0fc6486d60f0eb750c8b2f3162da67137166e
krb5-libs-1.18.2-8.el8.aarch64.rpm SHA-256: 55e93e89826db400efa8410e0170f2b478321ceff5aa2df314398b8d3cc1245e
krb5-libs-debuginfo-1.18.2-8.el8.aarch64.rpm SHA-256: 0d1726b72bf10378d25e8a5be6ddbc84d77c5419a0ffb4938b62b9266ab2f615
krb5-pkinit-1.18.2-8.el8.aarch64.rpm SHA-256: f1d6b30dd3afc1178294089fca53aa09d6d7e31e26155f90d857bf76c9dc70a0
krb5-pkinit-debuginfo-1.18.2-8.el8.aarch64.rpm SHA-256: e380563d104e7e79a794106653ae9b80709ffc4aa21d3e3814d16316e53c4af8
krb5-server-1.18.2-8.el8.aarch64.rpm SHA-256: e60dc13e5b9399455ecdc57e4ea37339a7b0fa90266f585cb08f976ec7c7b602
krb5-server-debuginfo-1.18.2-8.el8.aarch64.rpm SHA-256: 1ce7f67588396a83a336d5f5bd07aac05b9be4b9e096eb16b87bea5d978b9500
krb5-server-ldap-1.18.2-8.el8.aarch64.rpm SHA-256: ee1b1ec46bfb6423d32c99325c95ef299b138989283d5404cd72469252e2a134
krb5-server-ldap-debuginfo-1.18.2-8.el8.aarch64.rpm SHA-256: 243949785c5f70af45674d5e9e303007e16769868b48882c3bdf355154c94507
krb5-workstation-1.18.2-8.el8.aarch64.rpm SHA-256: c1cf924bc379378085df34949683f3d927389d03a134ce9efbc4e01555751a19
krb5-workstation-debuginfo-1.18.2-8.el8.aarch64.rpm SHA-256: 5c854efe8ea2ca6f576e010693231c06523c9a5d706b5886121bf149699354a1
libkadm5-1.18.2-8.el8.aarch64.rpm SHA-256: 1fa79239d3ef7e5e05bb286a79293730ce7c68c18a13b6c828081051ed603821
libkadm5-debuginfo-1.18.2-8.el8.aarch64.rpm SHA-256: fa95c402ed2a99f22bb946f553bd237519a738f49c6a90ce56128d87ff469e54

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.