README
1 Kerberos Version 5, Release 1.21
2
3 Release Notes
4 The MIT Kerberos Team
5
6Copyright and Other Notices
7---------------------------
8
9Copyright (C) 1985-2024 by the Massachusetts Institute of Technology
10and its contributors. All rights reserved.
11
12Please see the file named NOTICE for additional notices.
13
14Documentation
15-------------
16
17Unified documentation for Kerberos V5 is available in both HTML and
18PDF formats. The table of contents of the HTML format documentation
19is at doc/html/index.html, and the PDF format documentation is in the
20doc/pdf directory.
21
22Additionally, you may find copies of the HTML format documentation
23online at
24
25 https://web.mit.edu/kerberos/krb5-latest/doc/
26
27for the most recent supported release, or at
28
29 https://web.mit.edu/kerberos/krb5-devel/doc/
30
31for the release under development.
32
33More information about Kerberos may be found at
34
35 https://web.mit.edu/kerberos/
36
37and at the MIT Kerberos Consortium web site
38
39 https://kerberos.org/
40
41Building and Installing Kerberos 5
42----------------------------------
43
44Build documentation is in doc/html/build/index.html or
45doc/pdf/build.pdf.
46
47The installation guide is in doc/html/admin/install.html or
48doc/pdf/install.pdf.
49
50If you are attempting to build under Windows, please see the
51src/windows/README file.
52
53Reporting Bugs
54--------------
55
56Please report any problems/bugs/comments by sending email to
57krb5-bugs@mit.edu.
58
59You may view bug reports by visiting
60
61https://krbdev.mit.edu/rt/
62
63and using the "Guest Login" button. Please note that the web
64interface to our bug database is read-only for guests, and the primary
65way to interact with our bug database is via email.
66
67PAC transitions
68---------------
69
70Beginning with release 1.20, the KDC will include minimal PACs in
71tickets instead of AD-SIGNEDPATH authdata. S4U requests (protocol
72transition and constrained delegation) must now contain valid PACs in
73the incoming tickets. Beginning with release 1.21, service ticket
74PACs will contain a new KDC checksum buffer, to mitigate a hash
75collision attack against the old KDC checksum. If only some KDCs in a
76realm have been upgraded across versions 1.20 or 1.21, the upgraded
77KDCs will reject S4U requests containing tickets from non-upgraded
78KDCs and vice versa.
79
80Triple-DES and RC4 transitions
81------------------------------
82
83Beginning with the krb5-1.21 release, the KDC will not issue tickets
84with triple-DES or RC4 session keys unless explicitly configured using
85the new allow_des3 and allow_rc4 variables in [libdefaults]. To
86facilitate the negotiation of session keys, the KDC will assume that
87all services can handle aes256-sha1 session keys unless the service
88principal has a session_enctypes string attribute.
89
90Beginning with the krb5-1.19 release, a warning will be issued if
91initial credentials are acquired using the des3-cbc-sha1 encryption
92type. Beginning with the krb5-1.21 release, a warning will also be
93issued for the arcfour-hmac encryption type. In future releases,
94these encryption types will be disabled by default and eventually
95removed.
96
97Beginning with the krb5-1.18 release, all support for single-DES
98encryption types has been removed.
99
100Major changes in 1.21.3 (2024-06-26)
101------------------------------------
102
103This is a bug fix release.
104
105* Fix vulnerabilities in GSS message token handling [CVE-2024-37370,
106 CVE-2024-37371].
107
108* Fix a potential bad pointer free in krb5_cccol_have_contents().
109
110* Fix a memory leak in the macOS ccache type.
111
112krb5-1.21.2 changes by ticket ID
113--------------------------------
114
1159102 Eliminate sim_client include of getopt.h
1169103 segfault trying to free a garbage pointer
1179104 Work around Doxygen 1.9.7 change
1189107 In PKINIT, check for null PKCS7 enveloped fields
1199109 memory leak on macos
1209115 Fix leak in KDC NDR encoding
1219125 Formatting error in realm_config.rst
1229128 Fix vulnerabilities in GSS message token handling
123
124Major changes in 1.21.2 (2023-08-14)
125------------------------------------
126
127This is a bug fix release.
128
129* Fix double-free in KDC TGS processing [CVE-2023-39975].
130
131krb5-1.21.2 changes by ticket ID
132--------------------------------
133
1349101 Fix double-free in KDC TGS processing
135
136Major changes in 1.21.1 (2023-07-10)
137------------------------------------
138
139This is a bug fix release.
140
141* Fix potential uninitialized pointer free in kadm5 XDR parsing
142 [CVE-2023-36054].
143
144krb5-1.21.1 changes by ticket ID
145--------------------------------
146
1479099 Ensure array count consistency in kadm5 RPC
148
149Major changes in 1.21 (2023-06-05)
150----------------------------------
151
152User experience:
153
154* Added a credential cache type providing compatibility with the macOS
155 11 native credential cache.
156
157Developer experience:
158
159* libkadm5 will use the provided krb5_context object to read
160 configuration values, instead of creating its own.
161
162* Added an interface to retrieve the ticket session key from a GSS
163 context.
164
165Protocol evolution:
166
167* The KDC will no longer issue tickets with RC4 or triple-DES session
168 keys unless explicitly configured with the new allow_rc4 or
169 allow_des3 variables respectively.
170
171* The KDC will assume that all services can handle aes256-sha1 session
172 keys unless the service principal has a session_enctypes string
173 attribute.
174
175* Support for PAC full KDC checksums has been added to mitigate an
176 S4U2Proxy privilege escalation attack.
177
178* The PKINIT client will advertise a more modern set of supported CMS
179 algorithms.
180
181Code quality:
182
183* Removed unused code in libkrb5, libkrb5support, and the PKINIT
184 module.
185
186* Modernized the KDC code for processing TGS requests, the code for
187 encrypting and decrypting key data, the PAC handling code, and the
188 GSS library packet parsing and composition code.
189
190* Improved the test framework's detection of memory errors in daemon
191 processes when used with asan.
192
193krb5-1.21 changes by ticket ID
194------------------------------
195
1969052 Support macOS 11 native credential cache
1979053 Make kprop work for dump files larger than 4GB
1989054 Replace macros with typedefs in gssrpc types.h
1999055 Use SHA-256 instead of SHA-1 for PKINIT CMS digest
2009057 Omit LDFLAGS from krb5-config --libs output
2019058 Add configure variable for default PKCS#11 module
2029059 Use context profile for libkadm5 configuration
2039066 Set reasonable supportedCMSTypes in PKINIT
2049069 Update error checking for OpenSSL CMS_verify
2059071 Add and use ts_interval() helper
2069072 Avoid small read overrun in UTF8 normalization
2079076 Use memmove() in Unicode functions
2089077 Fix aclocal.m4 syntax error for autoconf 2.72
2099078 Fix profile crash on memory exhaustion
2109079 Fix preauth crash on memory exhaustion
2119080 Fix gic_keytab crash on memory exhaustion
2129082 Fix policy DB fallback error handling
2139083 Fix kpropd crash with unrecognized option
2149084 Add PAC full checksums
2159085 Fix read overruns in SPNEGO parsing
2169086 Fix possible double-free during KDB creation
2179087 Fix meridian type in getdate.y
2189088 Use control flow guard flag in Windows builds
2199089 Add pac_privsvr_enctype string attribute
2209090 Convey realm names to certauth modules
2219091 Add GSS_C_INQ_ODBC_SESSION_KEY
2229092 Fix maintainer-mode build for binutils 2.37
2239093 Add PA-REDHAT-PASSKEY padata type
224
225Acknowledgements
226----------------
227
228Past Sponsors of the MIT Kerberos Consortium:
229
230 Apple
231 Carnegie Mellon University
232 Centrify Corporation
233 Columbia University
234 Cornell University
235 The Department of Defense of the United States of America (DoD)
236 Fidelity Investments
237 Google
238 Iowa State University
239 MIT
240 Michigan State University
241 Microsoft
242 MITRE Corporation
243 Morgan-Stanley
244 The National Aeronautics and Space Administration
245 of the United States of America (NASA)
246 Network Appliance (NetApp)
247 Nippon Telephone and Telegraph (NTT)
248 US Government Office of the National Coordinator for Health
249 Information Technology (ONC)
250 Oracle
251 Pennsylvania State University
252 Red Hat
253 Stanford University
254 TeamF1, Inc.
255 The University of Alaska
256 The University of Michigan
257 The University of Pennsylvania
258
259Past and present members of the Kerberos Team at MIT:
260
261 Danilo Almeida
262 Jeffrey Altman
263 Justin Anderson
264 Richard Basch
265 Mitch Berger
266 Jay Berkenbilt
267 Andrew Boardman
268 Bill Bryant
269 Steve Buckley
270 Joe Calzaretta
271 John Carr
272 Mark Colan
273 Don Davis
274 Sarah Day
275 Alexandra Ellwood
276 Carlos Garay
277 Dan Geer
278 Nancy Gilman
279 Matt Hancher
280 Thomas Hardjono
281 Sam Hartman
282 Paul Hill
283 Marc Horowitz
284 Eva Jacobus
285 Miroslav Jurisic
286 Barry Jaspan
287 Benjamin Kaduk
288 Geoffrey King
289 Kevin Koch
290 John Kohl
291 HaoQi Li
292 Jonathan Lin
293 Peter Litwack
294 Scott McGuire
295 Steve Miller
296 Kevin Mitchell
297 Cliff Neuman
298 Paul Park
299 Ezra Peisach
300 Chris Provenzano
301 Ken Raeburn
302 Jon Rochlis
303 Jeff Schiller
304 Jen Selby
305 Robert Silk
306 Bill Sommerfeld
307 Jennifer Steiner
308 Ralph Swick
309 Brad Thompson
310 Harry Tsai
311 Zhanna Tsitkova
312 Ted Ts'o
313 Marshall Vale
314 Taylor Yu
315
316The following external contributors have provided code, patches, bug
317reports, suggestions, and valuable resources:
318
319 Ian Abbott
320 Daniel Albers
321 Brandon Allbery
322 Russell Allbery
323 Brian Almeida
324 Michael B Allen
325 Pooja Anil
326 Jeffrey Arbuckle
327 Heinz-Ado Arnolds
328 Derek Atkins
329 Mark Bannister
330 David Bantz
331 Alex Baule
332 Nikhil Benesch
333 David Benjamin
334 Thomas Bernard
335 Adam Bernstein
336 Arlene Berry
337 Jeff Blaine
338 Toby Blake
339 Radoslav Bodo
340 Alexander Bokovoy
341 Sumit Bose
342 Emmanuel Bouillon
343 Isaac Boukris
344 Ulf Bremer
345 Pavel Březina
346 Philip Brown
347 Samuel Cabrero
348 Michael Calmer
349 Andrea Campi
350 Julien Chaffraix
351 Jacob Champion
352 Puran Chand
353 Ravi Channavajhala
354 Srinivas Cheruku
355 Leonardo Chiquitto
356 Rachit Chokshi
357 Seemant Choudhary
358 Howard Chu
359 Andrea Cirulli
360 Christopher D. Clausen
361 Kevin Coffman
362 Simon Cooper
363 Sylvain Cortes
364 Ian Crowther
365 Arran Cudbard-Bell
366 Adam Dabrowski
367 Jeff D'Angelo
368 Nalin Dahyabhai
369 Mark Davies
370 Dennis Davis
371 Alex Dehnert
372 Misty De Meo
373 Mark Deneen
374 Günther Deschner
375 John Devitofranceschi
376 Marc Dionne
377 Roland Dowdeswell
378 Ken Dreyer
379 Dorian Ducournau
380 Viktor Dukhovni
381 Jason Edgecombe
382 Mark Eichin
383 Shawn M. Emery
384 Douglas E. Engert
385 Peter Eriksson
386 Juha Erkkilä
387 Gilles Espinasse
388 Sergey Fedorov
389 Ronni Feldt
390 Bill Fellows
391 JC Ferguson
392 Remi Ferrand
393 Paul Fertser
394 Fabiano Fidêncio
395 Frank Filz
396 William Fiveash
397 Jacques Florent
398 Oliver Freyermuth
399 Ákos Frohner
400 Sebastian Galiano
401 Marcus Granado
402 Dylan Gray
403 Norm Green
404 Scott Grizzard
405 Helmut Grohne
406 Steve Grubb
407 Philip Guenther
408 Timo Gurr
409 Dominic Hargreaves
410 Robbie Harwood
411 John Hascall
412 Jakob Haufe
413 Matthieu Hautreux
414 Jochen Hein
415 Paul B. Henson
416 Kihong Heo
417 Jeff Hodges
418 Christopher Hogan
419 Love Hörnquist Åstrand
420 Ken Hornstein
421 Henry B. Hotz
422 Luke Howard
423 Jakub Hrozek
424 Shumon Huque
425 Jeffrey Hutzelman
426 Sergey Ilinykh
427 Wyllys Ingersoll
428 Holger Isenberg
429 Spencer Jackson
430 Diogenes S. Jesus
431 Mike Jetzer
432 Pavel Jindra
433 Brian Johannesmeyer
434 Joel Johnson
435 Lutz Justen
436 Ganesh Kamath
437 Alexander Karaivanov
438 Anders Kaseorg
439 Bar Katz
440 Zentaro Kavanagh
441 Mubashir Kazia
442 W. Trevor King
443 Patrik Kis
444 Martin Kittel
445 Thomas Klausner
446 Tomasz Kłoczko
447 Matthew Krupcale
448 Mikkel Kruse
449 Reinhard Kugler
450 Harshawardhan Kulkarni
451 Tomas Kuthan
452 Pierre Labastie
453 Andreas Ladanyi
454 Chris Leick
455 Volker Lendecke
456 Jan iankko Lieskovsky
457 Todd Lipcon
458 Oliver Loch
459 Chris Long
460 Kevin Longfellow
461 Frank Lonigro
462 Jon Looney
463 Nuno Lopes
464 Todd Lubin
465 Ryan Lynch
466 Glenn Machin
467 Roland Mainz
468 Sorin Manolache
469 Robert Marshall
470 Andrei Maslennikov
471 Michael Mattioli
472 Nathaniel McCallum
473 Greg McClement
474 Cameron Meadors
475 Vipul Mehta
476 Alexey Melnikov
477 Ivan A. Melnikov
478 Franklyn Mendez
479 Mantas Mikulėnas
480 Markus Moeller
481 Kyle Moffett
482 Jon Moore
483 Paul Moore
484 Keiichi Mori
485 Michael Morony
486 Robert Morris
487 Sam Morris
488 Zbysek Mraz
489 Edward Murrell
490 Joshua Neuheisel
491 Nikos Nikoleris
492 Demi Obenour
493 Felipe Ortega
494 Michael Osipov
495 Andrej Ota
496 Dmitri Pal
497 Javier Palacios
498 Dilyan Palauzov
499 Tom Parker
500 Eric Pauly
501 Leonard Peirce
502 Ezra Peisach
503 Alejandro Perez
504 Zoran Pericic
505 W. Michael Petullo
506 Mark Phalan
507 Sharwan Ram
508 Brett Randall
509 Jonathan Reams
510 Jonathan Reed
511 Robert Relyea
512 Tony Reix
513 Martin Rex
514 Pat Riehecky
515 Julien Rische
516 Jason Rogers
517 Matt Rogers
518 Nate Rosenblum
519 Solly Ross
520 Mike Roszkowski
521 Guillaume Rousse
522 Joshua Schaeffer
523 Alexander Scheel
524 Jens Schleusener
525 Ryan Schmidt
526 Andreas Schneider
527 Paul Seyfert
528 Tom Shaw
529 Jim Shi
530 Jerry Shipman
531 Peter Shoults
532 Richard Silverman
533 Cel Skeggs
534 Simo Sorce
535 Anthony Sottile
536 Michael Spang
537 Michael Ströder
538 Bjørn Tore Sund
539 Ondřej Surý
540 Joseph Sutton
541 Joe Travaglini
542 Sergei Trofimovich
543 Greg Troxel
544 Fraser Tweedale
545 Tim Uglow
546 Rathor Vipin
547 Denis Vlasenko
548 Thomas Wagner
549 Jorgen Wahlsten
550 Stef Walter
551 Max (Weijun) Wang
552 John Washington
553 Stef Walter
554 Xi Wang
555 Nehal J Wani
556 Kevin Wasserman
557 Margaret Wasserman
558 Marcus Watts
559 Andreas Wiese
560 Simon Wilkinson
561 Nicolas Williams
562 Ross Wilper
563 Augustin Wolf
564 Garrett Wollman
565 David Woodhouse
566 Tsu-Phong Wu
567 Xu Qiang
568 Neng Xue
569 Zhaomo Yang
570 Tianjiao Yin
571 Nickolai Zeldovich
572 Bean Zhang
573 ChenChen Zhou
574 Hanz van Zijst
575 Gertjan Zwartjes
576
577The above is not an exhaustive list; many others have contributed in
578various ways to the MIT Kerberos development effort over the years.
579