Update for krb5-1.17.2

diff --git a/README b/README
index 72b5121deafa2583788ef127670f67f0757b7f7f..68a2cf918bfc52de2f6ff4da8fefd3d9b2c0b245 100644 (file)
--- a/README
+++ b/README
@@ -73,6 +73,43 @@ from using single-DES cryptosystems.  Among these is a configuration
 variable that enables "weak" enctypes, which defaults to "false"
 beginning with krb5-1.8.
 
+Major changes in 1.17.2 (2020-11-17)
+------------------------------------
+
+This is a bug fix release.
+
+* Fix a denial of service vulnerability when decoding Kerberos
+  protocol messages.
+
+* Fix a locking issue with the LMDB KDB module which could cause KDC
+  and kadmind processes to lose access to the database.
+
+* Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
+  and unloaded while libkrb5support remains loaded.
+
+* Fix a null deference when processing a CAMMAC with an invalid
+  service verifier.
+
+krb5-1.17.2 changes by ticket ID
+--------------------------------
+
+8614    Assertion failure when repeatedly loading libgssapi_krb5
+8856    Null dereference in CAMMAC processing
+8861    Fix LDAP policy enforcement of pw_expiration
+8864    Fix error handling in gssint_mechglue_init()
+8872    Put KDB authdata first
+8873    Don't assume OpenSSL failures are memory errors
+8877    Cannot remove require_auth attribute with LDAP KDB module
+8882    kdb5_util load ignores password expiration with LDAP KDB module
+8894    Correct formatting of trace log microseconds
+8918    KDC and kadmind fork with DB open, breaking LMDB KDB module
+8933    Fix input length checking in SPNEGO DER decoding
+8936    Set lockdown attribute when creating LDAP KDB
+8938    Leash crashes on failure to auto-renew tickets
+8939    Suppress Leash error popup on MSLSA renew failure
+8959    Add recursion limit for ASN.1 indefinite lengths
+8960    Fix compatibility with upcoming autoconf 2.70
+
 Major changes in 1.17.1 (2019-12-11)
 ------------------------------------
 
@@ -397,6 +434,7 @@ reports, suggestions, and valuable resources:
     Brian Almeida
     Michael B Allen
     Pooja Anil
+    Jeffrey Arbuckle
     Heinz-Ado Arnolds
     Derek Atkins
     Mark Bannister
@@ -429,6 +467,7 @@ reports, suggestions, and valuable resources:
     Sylvain Cortes
     Ian Crowther
     Arran Cudbard-Bell
+    Adam Dabrowski
     Jeff D'Angelo
     Nalin Dahyabhai
     Mark Davies
@@ -518,6 +557,7 @@ reports, suggestions, and valuable resources:
     Nuno Lopes
     Todd Lubin
     Ryan Lynch
+    Glenn Machin
     Roland Mainz
     Sorin Manolache
     Andrei Maslennikov
@@ -535,6 +575,7 @@ reports, suggestions, and valuable resources:
     Zbysek Mraz
     Edward Murrell
     Nikos Nikoleris
+    Demi Obenour
     Felipe Ortega
     Michael Osipov
     Andrej Ota
@@ -575,6 +616,7 @@ reports, suggestions, and valuable resources:
     Michael Ströder
     Bjørn Tore Sund
     Joe Travaglini
+    Sergei Trofimovich
     Tim Uglow
     Rathor Vipin
     Denis Vlasenko

diff --git a/src/man/k5identity.man b/src/man/k5identity.man
index c2a22b0000e2e01eac22e476ad3cc9cf3a14b3d7..d33b0ba4dec389ec428971cc11e5e4a7accacdf4 100644 (file)
--- a/src/man/k5identity.man
+++ b/src/man/k5identity.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5IDENTITY" "5" " " "1.17.1" "MIT Kerberos"
+.TH "K5IDENTITY" "5" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 k5identity \- Kerberos V5 client principal selection rules
 .

diff --git a/src/man/k5login.man b/src/man/k5login.man
index 4b23e4340971b023361c7f031364d96a2b725689..57b997c243278941b322d797366e7e87d95f5b4b 100644 (file)
--- a/src/man/k5login.man
+++ b/src/man/k5login.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5LOGIN" "5" " " "1.17.1" "MIT Kerberos"
+.TH "K5LOGIN" "5" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 k5login \- Kerberos V5 acl file for host access
 .

diff --git a/src/man/k5srvutil.man b/src/man/k5srvutil.man
index 22b537cf760fdd6f99c9b3689609f470cb724d39..151c909fb38b41daee54596c80ae6bb57dedbae3 100644 (file)
--- a/src/man/k5srvutil.man
+++ b/src/man/k5srvutil.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5SRVUTIL" "1" " " "1.17.1" "MIT Kerberos"
+.TH "K5SRVUTIL" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 k5srvutil \- host key table (keytab) manipulation utility
 .

diff --git a/src/man/kadm5.acl.man b/src/man/kadm5.acl.man
index 6e954f91981e6c6c69bab84a604dceec0e20d13e..7155cd532107becdca43e08cf9bc6f702859e0a1 100644 (file)
--- a/src/man/kadm5.acl.man
+++ b/src/man/kadm5.acl.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADM5.ACL" "5" " " "1.17.1" "MIT Kerberos"
+.TH "KADM5.ACL" "5" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kadm5.acl \- Kerberos ACL file
 .

diff --git a/src/man/kadmin.man b/src/man/kadmin.man
index 3668e76352ff84c88622be44d9b6078ffec178b3..e69a440f8c72d6d527ec421202fc04e92105a486 100644 (file)
--- a/src/man/kadmin.man
+++ b/src/man/kadmin.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADMIN" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KADMIN" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kadmin \- Kerberos V5 database administration program
 .

diff --git a/src/man/kadmind.man b/src/man/kadmind.man
index dc6a00f34c1a2f8baaecf2f782b9122309306e90..973e45c938550d975f71fc142e3d476dbb3ecc43 100644 (file)
--- a/src/man/kadmind.man
+++ b/src/man/kadmind.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADMIND" "8" " " "1.17.1" "MIT Kerberos"
+.TH "KADMIND" "8" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kadmind \- KADM5 administration server
 .

diff --git a/src/man/kdb5_ldap_util.man b/src/man/kdb5_ldap_util.man
index aa159aab8f791517b0e2c4209340318deacf8b46..f15bc4306ef74fc14d50ddcd48ba2d151bc512f9 100644 (file)
--- a/src/man/kdb5_ldap_util.man
+++ b/src/man/kdb5_ldap_util.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDB5_LDAP_UTIL" "8" " " "1.17.1" "MIT Kerberos"
+.TH "KDB5_LDAP_UTIL" "8" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kdb5_ldap_util \- Kerberos configuration utility
 .

diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
index 52c51ccaaa0ffacd9a47806e1a0c719969abc5ae..28c87ac043bc0bfd3b60593e239d7d009d443d5b 100644 (file)
--- a/src/man/kdb5_util.man
+++ b/src/man/kdb5_util.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDB5_UTIL" "8" " " "1.17.1" "MIT Kerberos"
+.TH "KDB5_UTIL" "8" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kdb5_util \- Kerberos database maintenance utility
 .

diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index 14d96602daf1d77cf04479bbf09a3a4bedf11926..61e1a6e9c6ed403496a2493437a4b329a22c72f1 100644 (file)
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDC.CONF" "5" " " "1.17.1" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kdc.conf \- Kerberos V5 KDC configuration file
 .

diff --git a/src/man/kdestroy.man b/src/man/kdestroy.man
index bb88b571524e768888e950f0267eda7c9d6f25e6..cd7ae688c35c045f6426b1ff434b779d2422064d 100644 (file)
--- a/src/man/kdestroy.man
+++ b/src/man/kdestroy.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDESTROY" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KDESTROY" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kdestroy \- destroy Kerberos tickets
 .

diff --git a/src/man/kerberos.man b/src/man/kerberos.man
index 0b4267ba8741a6c7edd7d4a4c82d9e06e0451703..125ae9910dc33ae3c7b0dc49515108af1169189a 100644 (file)
--- a/src/man/kerberos.man
+++ b/src/man/kerberos.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KERBEROS" "7" " " "1.17.1" "MIT Kerberos"
+.TH "KERBEROS" "7" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kerberos \- Overview of using Kerberos
 .

diff --git a/src/man/kinit.man b/src/man/kinit.man
index b3bd7b2f4db897c1ea99bab2c67db87da9b5d8ab..28ac5d57bb1ae984996a4e6b432a030c2e2a4652 100644 (file)
--- a/src/man/kinit.man
+++ b/src/man/kinit.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KINIT" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KINIT" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kinit \- obtain and cache Kerberos ticket-granting ticket
 .

diff --git a/src/man/klist.man b/src/man/klist.man
index f3c6148fcddf20b2cf67c4de93bf0e294309cfaa..a294551eeb09d0931c69feb03419c2411f471b46 100644 (file)
--- a/src/man/klist.man
+++ b/src/man/klist.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KLIST" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KLIST" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 klist \- list cached Kerberos tickets
 .

diff --git a/src/man/kpasswd.man b/src/man/kpasswd.man
index 32ef2c63cea724143c226c8f65a386ea6f2ad9f5..8cd0f272a35a7b581d8466bfc9098b0100e7721d 100644 (file)
--- a/src/man/kpasswd.man
+++ b/src/man/kpasswd.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPASSWD" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KPASSWD" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kpasswd \- change a user's Kerberos password
 .

diff --git a/src/man/kprop.man b/src/man/kprop.man
index ac9ccbccdf3404dafe763d55da58c4fa433c1215..b1464ac7ad1897a80c6f4da80cea3ed3102995e2 100644 (file)
--- a/src/man/kprop.man
+++ b/src/man/kprop.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROP" "8" " " "1.17.1" "MIT Kerberos"
+.TH "KPROP" "8" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kprop \- propagate a Kerberos V5 principal database to a replica server
 .

diff --git a/src/man/kpropd.man b/src/man/kpropd.man
index 8eaf4dc9b3d72f0d50046faae8897803c040fa8f..73344816f147a17e1f43f821be3e96cca9413d7d 100644 (file)
--- a/src/man/kpropd.man
+++ b/src/man/kpropd.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROPD" "8" " " "1.17.1" "MIT Kerberos"
+.TH "KPROPD" "8" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kpropd \- Kerberos V5 replica KDC update server
 .

diff --git a/src/man/kproplog.man b/src/man/kproplog.man
index ec844905ef8840fc118c3c8c82a5978806718ecc..444facdbe728d5c76f7a240f22ca1c2ef6ad987c 100644 (file)
--- a/src/man/kproplog.man
+++ b/src/man/kproplog.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROPLOG" "8" " " "1.17.1" "MIT Kerberos"
+.TH "KPROPLOG" "8" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kproplog \- display the contents of the Kerberos principal update log
 .

diff --git a/src/man/krb5-config.man b/src/man/krb5-config.man
index 8deb1b750160ddb1fb091902e5cac7818e3f57c6..f872fa53a42764a9e9d0ac33c0410770f252552a 100644 (file)
--- a/src/man/krb5-config.man
+++ b/src/man/krb5-config.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5-CONFIG" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KRB5-CONFIG" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 krb5-config \- tool for linking against MIT Kerberos libraries
 .

diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index d04c8fc8795fe9bdfea1cbc22bc80b3a69942007..cadf1afc32833ee7a68e6f401b5bf58691886f50 100644 (file)
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5.CONF" "5" " " "1.17.1" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 krb5.conf \- Kerberos configuration file
 .

diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
index 4a8d3b3c758d671c5465c0231be7d454830302dc..489a586c5d9b69460bc46fb5c22c0cb00ab656a9 100644 (file)
--- a/src/man/krb5kdc.man
+++ b/src/man/krb5kdc.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5KDC" "8" " " "1.17.1" "MIT Kerberos"
+.TH "KRB5KDC" "8" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 krb5kdc \- Kerberos V5 KDC
 .

diff --git a/src/man/ksu.man b/src/man/ksu.man
index c6592ceddf6a2049e684b24197b7b6c622199d75..bb2a65604915e6eb52754de3d14e085d15586af7 100644 (file)
--- a/src/man/ksu.man
+++ b/src/man/ksu.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KSU" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KSU" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 ksu \- Kerberized super-user
 .

diff --git a/src/man/kswitch.man b/src/man/kswitch.man
index 3b89b8a43ff0c601866082dd4e9f84286aadd56f..60d8c1934dfcb1b09e0272cc7d451ab587ee612b 100644 (file)
--- a/src/man/kswitch.man
+++ b/src/man/kswitch.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KSWITCH" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KSWITCH" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kswitch \- switch primary ticket cache
 .

diff --git a/src/man/ktutil.man b/src/man/ktutil.man
index 69d072686c2c325e05b35c5f8998bcaa0051354c..b926c975f6c62c5abd16e8e5890c64fcd55d18d0 100644 (file)
--- a/src/man/ktutil.man
+++ b/src/man/ktutil.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KTUTIL" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KTUTIL" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 ktutil \- Kerberos keytab file maintenance utility
 .

diff --git a/src/man/kvno.man b/src/man/kvno.man
index 0fc43f0329d536fdd3e23a64fbaeecd536181c7d..4b07d210eb1f4e890a0a39141069fdff3b6db550 100644 (file)
--- a/src/man/kvno.man
+++ b/src/man/kvno.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KVNO" "1" " " "1.17.1" "MIT Kerberos"
+.TH "KVNO" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 kvno \- print key version numbers of Kerberos principals
 .

diff --git a/src/man/sclient.man b/src/man/sclient.man
index 0f515b83d85336baf78abcb8c7385f0122adcaff..4f1a4815fc675d084fced96f9d0230aba3baadce 100644 (file)
--- a/src/man/sclient.man
+++ b/src/man/sclient.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SCLIENT" "1" " " "1.17.1" "MIT Kerberos"
+.TH "SCLIENT" "1" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 sclient \- sample Kerberos version 5 client
 .

diff --git a/src/man/sserver.man b/src/man/sserver.man
index 8534f5178d860ec9df7e03149d797563ea4b40e4..4bff92a00e76d3136c8618075269ac178dd44024 100644 (file)
--- a/src/man/sserver.man
+++ b/src/man/sserver.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SSERVER" "8" " " "1.17.1" "MIT Kerberos"
+.TH "SSERVER" "8" " " "1.17.2" "MIT Kerberos"
 .SH NAME
 sserver \- sample Kerberos version 5 server
 .

diff --git a/src/patchlevel.h b/src/patchlevel.h
index 74f0032320bf187757066e3ddb3b3ea4a645eafb..296bbf212b861892e03aea3c61e5cdabf38c96df 100644 (file)
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -51,7 +51,7 @@
  */
 #define KRB5_MAJOR_RELEASE 1
 #define KRB5_MINOR_RELEASE 17
-#define KRB5_PATCHLEVEL 1
-#define KRB5_RELTAIL "kfw-4.2-beta2-mit"
+#define KRB5_PATCHLEVEL 2
+/* #undef KRB5_RELTAIL */
 /* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "kfw-4.2-beta2-mit"
+#define KRB5_RELTAG "krb5-1.17.2-final"

diff --git a/src/po/mit-krb5.pot b/src/po/mit-krb5.pot
index a5ec99d7247c6326a5fa753de1279ca794f2b3ec..c1f6e12cbe5226b01ae9360560e8b92d836289d9 100644 (file)
--- a/src/po/mit-krb5.pot
+++ b/src/po/mit-krb5.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: mit-krb5 1.17.1-kfw-4.2-beta2-mit\n"
+"Project-Id-Version: mit-krb5 1.17.2\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2020-11-17 00:57-0500\n"
+"POT-Creation-Date: 2020-11-17 11:54-0500\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"