Control: tags -1 + patch Hi Sam, hi Salvatore,
In case it saves some time, attached is a debdiff for a 1.22.1-3.1 NMU
that fixes both CVEs. I have not uploaded anything; please use as much
or as little of it as you like.
It adds five upstream commits as gbp-pq style patches (0017-0021):
0017 a88a18ca CVE-2026-107708: Fix error handling in KDC PAC processing
(krb5-1.22 branch, cherry-pick of f6e2c397)
0018 62196e2b CVE-2026-107778: Avoid null dereference in krb5_rd_cred()
(krb5-1.22, cherry-pick of 48afa9ab)
0019 09ede2e5 Avoid another null dereference in krb5_rd_cred()
(krb5-1.22, ticket 9219)
0020 71bac898 Check for empty forwarded creds in krb5 GSS mech
(krb5-1.22, ticket 9220)
0021 c2697c12 Force "fork" method in t_otp.py (master, test only)
Notes:
- 0019 and 0020 are not mentioned in the tracker, but they are the
upstream follow-ups to the same make_cred_list()/gss_accept_sec_context()
crash: 0019 covers a KrbCredInfo without pname/sname (both are optional
in RFC 4120), 0020 an empty forwarded-creds list. Without 0019 the
CVE-2026-107778 fix is easy to sidestep.
- 0021 is needed for the package to build in current sid at all: with
Python 3.14 the multiprocessing default is "forkserver", and
src/tests/t_otp.py then fails ("Address already in use" on the KDC
port, ConnectionResetError from the RADIUS daemon). I reproduced the
failure with the unmodified 1.22.1-3 sources, so this is independent
of the CVE patches.
Testing (sid chroot, amd64):
- dpkg-buildpackage with the full test suite: all tests pass (only the
usual skips for slapd, SoftHSMv2 and systemd-socket-activate).
- A small reproducer that feeds malformed KRB-CRED messages to
krb5_rd_cred() with a keyless auth context (the fallback that
rd_and_store_for_creds() uses):
more tickets than ticket-info entries: 1.22.1-3 SIGSEGV,
1.22.1-3.1 KRB5KRB_AP_ERR_MODIFIED
ticket-info entry without client name: 1.22.1-3 SIGSEGV,
1.22.1-3.1 KRB5KRB_AP_ERR_MODIFIED
I did not build a reproducer for the empty-list case (0020) or for the
KDC PAC case (0017); those rely on upstream's review and test suite.
- lintian: source tags identical to 1.22.1-3; no new binary tags related
to the change.
- The upstream commits were taken from
https://www.google.com/url?q=http://github.com/krb5/krb5&source=gmail&ust=1793552463216000&sa=E
and checked
by full commit id against the krb5-1.22 and master branches.
All four patches apply to the krb5-1.22 branch commits without fuzz, so
they should also be usable for the trixie-pu update Salvatore mentioned.
Thanks for maintaining krb5!
Regards,
automationcanadian
krb5_1.22.1-3.1.debdiff.gz
Description: GNU Zip compressed data
