CVS commit: pkgsrc/security/mit-krb5

["Adam Ciarcinski" <adam%netbsd.org@localhost>]

Module Name:    pkgsrc
Committed By:   adam
Date:           Tue Nov 10 12:51:14 UTC 2026

Modified Files:
        pkgsrc/security/mit-krb5: Makefile distinfo
Removed Files:
        pkgsrc/security/mit-krb5/patches: patch-lib_krb5_ccache_ccbase.c
            patch-lib_krb5_os_expand__path.c patch-lib_krb5_os_locate__kdc.c
            patch-plugins_preauth_pkinit_pkinit__crypto.h
            patch-plugins_preauth_pkinit_pkinit__crypto__openssl.c
            patch-plugins_preauth_pkinit_pkinit__identity.c
            patch-plugins_preauth_pkinit_pkinit__matching.c

Log Message:
mit-krb5: updated to 1.22.3

Major changes in 1.22.3 (2026-11-09)

Fix a logic error when checking PAC server checksums [CVE-2026-111423].
Check for unkeyed checksums when validating CAMMAC verifiers [CVE-2026-71199].
Fix a loophole in the KDC's client authdata filtering which could allow clients to include fake PAC and CAMMAC authdata values when requesting service tickets. These fake values would be rejected by 
application servers, were it not for the two bugs noted above.
Check for the lockdown_keys attribute when processing password change protocol requests in kadmind [CVE-2026-107884].
In libgssrpc, when processing RPC messages using the RPCSEC_GSS flavor, use the verified service type included in the RPC request to determine how to unwrap arguments and wrap return values, instead 
of the unverified service type included during authentication [CVE-2026-118380].
In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the "GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set. AUTH_GSSAPI is only needed for very old (pre-1.4) clients [CVE-2026-112322] 
[CVE-2026-112323].
Fix numerous null pointer deferences, read overruns, unbounded memory allocations, and memory leaks that could be used as denial of service attacks against the KDC, kadmind, application servers, or 
client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200] [CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778] [CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316] [CVE-2026-112317] 
[CVE-2026-112318] [CVE-2026-112319] [CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323] [CVE-2026-119079].
Fix a client crash when a KKDCP proxy daemon closes the TLS session without supplying any response data.
Shut down kpropd gracefully when a termination signal is received, when operating in incremental propagation mode.
Detect when an incremental propagation update is applied to a nonexistent principal; when this happens, force a full resync instead of crashing.
Fix a KDC crash when the LDAP KDB module loses its connection to the LDAP server.
Avoid a crash on macOS when the native API ccache type is used before and after forking a process.
When an application accepts a GSS context without asking for delegated credentials, discard any credentials sent by the initiator without parsing them first.
On Windows, prevent buffer overflows when the KDC sends an unexpectedly long prompt string via OTP preauthentication.
On Windows, move the default per-machine krb5.ini location from C:\ProgramData\MIT\Kerberos to C:\Program Files\MIT\Kerberos5, as the former location could be pre-created by an unutrusted user before 
KfW installation.
On Windows, add error checking to kfwlogon to ensure that it does not set ACLs on a cache file it did not create.
On Windows, prevent several buffer overflows that could occur if an application passes a large principal name to leashdll APIs.
On Windows, prevent buffer overflows when the LSA cache contains credentials with long principal name components.


To generate a diff of this commit:
cvs rdiff -u -r1.124 -r1.125 pkgsrc/security/mit-krb5/Makefile
cvs rdiff -u -r1.84 -r1.85 pkgsrc/security/mit-krb5/distinfo
cvs rdiff -u -r1.1 -r0 \
    pkgsrc/security/mit-krb5/patches/patch-lib_krb5_ccache_ccbase.c \
    pkgsrc/security/mit-krb5/patches/patch-lib_krb5_os_expand__path.c \
    pkgsrc/security/mit-krb5/patches/patch-plugins_preauth_pkinit_pkinit__crypto.h \
    pkgsrc/security/mit-krb5/patches/patch-plugins_preauth_pkinit_pkinit__crypto__openssl.c \
    pkgsrc/security/mit-krb5/patches/patch-plugins_preauth_pkinit_pkinit__identity.c \
    pkgsrc/security/mit-krb5/patches/patch-plugins_preauth_pkinit_pkinit__matching.c
cvs rdiff -u -r1.2 -r0 \
    pkgsrc/security/mit-krb5/patches/patch-lib_krb5_os_locate__kdc.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.

Modified files:

Index: pkgsrc/security/mit-krb5/Makefile
diff -u pkgsrc/security/mit-krb5/Makefile:1.124 pkgsrc/security/mit-krb5/Makefile:1.125
--- pkgsrc/security/mit-krb5/Makefile:1.124     Tue Apr  7 14:12:48 2026
+++ pkgsrc/security/mit-krb5/Makefile   Tue Nov 10 12:51:14 2026
@@ -1,7 +1,7 @@
-# $NetBSD: Makefile,v 1.124 2026/04/07 14:12:48 tnn Exp $
+# $NetBSD: Makefile,v 1.125 2026/11/10 12:51:14 adam Exp $
 
 BRANCHNAME=    1.22
-DISTNAME=      krb5-${BRANCHNAME}.2
+DISTNAME=      krb5-${BRANCHNAME}.3
 PKGNAME=       mit-${DISTNAME}
 CATEGORIES=    security
 # It is not clear how stable this URL scheme is.
@@ -10,13 +10,12 @@ MASTER_SITES=       http://web.mit.edu/kerbero
 MAINTAINER=    tez%NetBSD.org@localhost
 HOMEPAGE=      https://web.mit.edu/kerberos/
 COMMENT=       MIT Kerberos 5 authentication system
-
 # There is a file NOTICE in the sources, which is enormous.  Most
 # licenses appear to be some flavor of X11, 3-clause BSD, 4-clause
 # BSD.
 # 20201007: gdt emailed upstream asking for clarification on the AES
 # license, which is not entirely clearly Free, by the text.
-#LICENSE=
+#LICENSE=      2-clause-bsd
 
 # TODO: This is entirely caused by our libtool patches, which are also
 # actively harmful when trying to run the test suite.  They should really
@@ -38,7 +37,7 @@ USE_LANGUAGES=                c
 # c99, and configure checks for that.  The code uses strdup(3):
 # https://pubs.opengroup.org/onlinepubs/9799919799/functions/strdup.html
 # and that's hidden by default on Linux, with gnu99 making it visible.
-USE_CC_FEATURES+=      c99
+USE_CC_FEATURES=       c99
 FORCE_C_STD=           gnu99
 
 USE_LIBTOOL=           yes

Index: pkgsrc/security/mit-krb5/distinfo
diff -u pkgsrc/security/mit-krb5/distinfo:1.84 pkgsrc/security/mit-krb5/distinfo:1.85
--- pkgsrc/security/mit-krb5/distinfo:1.84      Fri Apr 10 10:38:05 2026
+++ pkgsrc/security/mit-krb5/distinfo   Tue Nov 10 12:51:14 2026
@@ -1,8 +1,8 @@
-$NetBSD: distinfo,v 1.84 2026/04/10 10:38:05 jperkin Exp $
+$NetBSD: distinfo,v 1.85 2026/11/10 12:51:14 adam Exp $
 
-BLAKE2s (krb5-1.22.2.tar.gz) = d43a371657c4def55ee2502f9b5ac6ab2e9263b077dd94fecc717cb3cd85e6f5
-SHA512 (krb5-1.22.2.tar.gz) = 3237cacfb2019285107991a3211e0d74944c605942ab38a8b4b372703b8f02f5779fa2de80c4e201bd59703d557f37ac346bdc5ea14b986b0a0db23eb422fc6f
-Size (krb5-1.22.2.tar.gz) = 8747729 bytes
+BLAKE2s (krb5-1.22.3.tar.gz) = bb034476f18383bd183a51a41b95c42aa1b86ce647093def13b2516e357ba004
+SHA512 (krb5-1.22.3.tar.gz) = 0276d83dee90e76d50a506d22901e658212094c1191fc09b8510273b4bfc56195ab1dd1c80b5fd8288b4aa9323c62f0b60ab3f6227ea113b4712bc54cb144abb
+Size (krb5-1.22.3.tar.gz) = 8758584 bytes
 SHA1 (patch-Makefile.in) = cebe3ea0cf9d142f6e4ee50a47940fe2bc3b8c03
 SHA1 (patch-aclocal.m4) = 07b5d9ae38c74eaea6ba62aed9062dca1bf7f3fb
 SHA1 (patch-build-tools_krb5-config.in) = 4ab922df1d86d86f9ef043f2c5cdf048c0477d3a
@@ -24,18 +24,11 @@ SHA1 (patch-lib_gssapi_krb5_import__name
 SHA1 (patch-lib_kdb_Makefile.in) = 0c45e34ea8b5d0270c386d430b0d37469e8440ea
 SHA1 (patch-lib_kdb_kdb__log.c) = dc759fae6099e7586686bcf14d7cd775854e0360
 SHA1 (patch-lib_krb5_ccache_Makefile.in) = 330ae21ec3b290ae16478c2c49a138acac5bf2fd
-SHA1 (patch-lib_krb5_ccache_ccbase.c) = 421b8f1f4fb9d42580e6cd493006b63eb077ce9e
 SHA1 (patch-lib_krb5_os_addr.c) = c01eedbff966e0e61b68df71a7b19f714474449b
-SHA1 (patch-lib_krb5_os_expand__path.c) = 20530c7a29cef443713d2c6e50b934ec0366796e
-SHA1 (patch-lib_krb5_os_locate__kdc.c) = dd2469f4e78c25f01e90d4b388cce4a88beab733
 SHA1 (patch-plugins_kdb_db2_Makefile.in) = eae56f7f450a299bdf1d86ee491af1fd51bd1d0c
 SHA1 (patch-plugins_kdb_db2_libdb2_Makefile.in) = b4b7e8e4192b5e5318f1e42c49315789619f3ae9
 SHA1 (patch-plugins_kdb_ldap_ldap__util_Makefile.in) = 7aa0f44cc02c523c837e7e3e1766624d2323deb9
 SHA1 (patch-plugins_preauth_otp_Makefile.in) = 8c779e3b37cab4138f300f4a09325387092c79f8
 SHA1 (patch-plugins_preauth_pkinit_Makefile.in) = 8764289caeb6b043cd2f8ee5ffbbabea4619a198
-SHA1 (patch-plugins_preauth_pkinit_pkinit__crypto.h) = 14ea95f7fef161380615d7a515838f1d96dd2426
-SHA1 (patch-plugins_preauth_pkinit_pkinit__crypto__openssl.c) = a13b936d79b14b8f8d3cd73329be519831f06750
-SHA1 (patch-plugins_preauth_pkinit_pkinit__identity.c) = 27529ec668c65120acdd1dd8ea603a7a59e7d43a
-SHA1 (patch-plugins_preauth_pkinit_pkinit__matching.c) = 53d4cfdc808a1c14897fc83b7ad2772039a1f154
 SHA1 (patch-util_ss_Makefile.in) = 5ca0bf7295a8f4c1d8e59097863940f88d224ee7
 SHA1 (patch-util_verto_verto-k5ev.c) = 8f074ddccbaaa03576f0302437aed3aaad1b738d