USN-6467-2: Kerberos vulnerability

Releases

• Ubuntu 23.04
• Ubuntu 22.04 LTS
• Ubuntu 20.04 LTS

Packages

• krb5 - MIT Kerberos Network Authentication Protocol

Details

USN-6467-1 fixed a vulnerability in Kerberos. This update provides the
corresponding update for Ubuntu 20.04 LTS, Ubuntu 22.04 LTS and Ubuntu
23.04.

Original advisory details:

Robert Morris discovered that Kerberos did not properly handle memory
access when processing RPC data through kadmind, which could lead to the
freeing of uninitialized memory. An authenticated remote attacker could
possibly use this issue to cause kadmind to crash, resulting in a denial
of service.

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 23.04

• krb5-admin-server - 1.20.1-1ubuntu0.1
• krb5-kdc - 1.20.1-1ubuntu0.1
• krb5-kdc-ldap - 1.20.1-1ubuntu0.1
• krb5-otp - 1.20.1-1ubuntu0.1
• krb5-pkinit - 1.20.1-1ubuntu0.1
• krb5-user - 1.20.1-1ubuntu0.1
• libgssapi-krb5-2 - 1.20.1-1ubuntu0.1
• libgssrpc4 - 1.20.1-1ubuntu0.1
• libk5crypto3 - 1.20.1-1ubuntu0.1
• libkadm5clnt-mit12 - 1.20.1-1ubuntu0.1
• libkadm5srv-mit12 - 1.20.1-1ubuntu0.1
• libkdb5-10 - 1.20.1-1ubuntu0.1
• libkrad0 - 1.20.1-1ubuntu0.1
• libkrb5-3 - 1.20.1-1ubuntu0.1
• libkrb5support0 - 1.20.1-1ubuntu0.1

Ubuntu 22.04

• krb5-admin-server - 1.19.2-2ubuntu0.3
• krb5-kdc - 1.19.2-2ubuntu0.3
• krb5-kdc-ldap - 1.19.2-2ubuntu0.3
• krb5-otp - 1.19.2-2ubuntu0.3
• krb5-pkinit - 1.19.2-2ubuntu0.3
• krb5-user - 1.19.2-2ubuntu0.3
• libgssapi-krb5-2 - 1.19.2-2ubuntu0.3
• libgssrpc4 - 1.19.2-2ubuntu0.3
• libk5crypto3 - 1.19.2-2ubuntu0.3
• libkadm5clnt-mit12 - 1.19.2-2ubuntu0.3
• libkadm5srv-mit12 - 1.19.2-2ubuntu0.3
• libkdb5-10 - 1.19.2-2ubuntu0.3
• libkrad0 - 1.19.2-2ubuntu0.3
• libkrb5-3 - 1.19.2-2ubuntu0.3
• libkrb5support0 - 1.19.2-2ubuntu0.3

Ubuntu 20.04

• krb5-admin-server - 1.17-6ubuntu4.4
• krb5-kdc - 1.17-6ubuntu4.4
• krb5-kdc-ldap - 1.17-6ubuntu4.4
• krb5-otp - 1.17-6ubuntu4.4
• krb5-pkinit - 1.17-6ubuntu4.4
• krb5-user - 1.17-6ubuntu4.4
• libgssapi-krb5-2 - 1.17-6ubuntu4.4
• libgssrpc4 - 1.17-6ubuntu4.4
• libk5crypto3 - 1.17-6ubuntu4.4
• libkadm5clnt-mit11 - 1.17-6ubuntu4.4
• libkadm5srv-mit11 - 1.17-6ubuntu4.4
• libkdb5-9 - 1.17-6ubuntu4.4
• libkrad0 - 1.17-6ubuntu4.4
• libkrb5-3 - 1.17-6ubuntu4.4
• libkrb5support0 - 1.17-6ubuntu4.4

In general, a standard system update will make all the necessary changes.

References

• CVE-2023-36054

Related notices

• USN-6467-1: libk5crypto3, libkdb5-8, krb5-user, libkrb5-dev, libkadm5clnt-mit9, krb5-doc, libkadm5srv-mit11, krb5-k5tls, krb5-pkinit, krb5-admin-server, libkdb5-7, libkadm5srv-mit9, krb5-kpropd, krb5-otp, libkrb5support0, libkrb5-3, krb5-multidev, libkadm5clnt-mit11, krb5-locales, libkrad0, libkadm5srv-mit8, krb5-kdc-ldap, krb5, libkdb5-9, libgssapi-krb5-2, libkrad-dev, libgssrpc4, krb5-gss-samples, krb5-kdc