Updates for krb5-1.13.3

diff --git a/README b/README
index 0e2a392c0e618491ae0d87d4a211c6f3d676eb69..a5c2ecb1c6751fc38d7bb4e3a7cac8d4953c20c7 100644 (file)
--- a/README
+++ b/README
@@ -74,6 +74,57 @@ variable that enables "weak" enctypes, which defaults to "false"
 beginning with krb5-1.8.
 
 
+Major changes in 1.13.3 (2015-12-04)
+------------------------------------
+
+This is a bug fix release.  The krb5-1.13 release series is in
+maintenance, and for new deployments, installers should prefer the
+krb5-1.14 release series or later.
+
+* Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
+  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
+  [CVE-2015-2698]
+
+* Fix build_principal memory bug that could cause a KDC
+  crash. [CVE-2015-2697]
+
+* Allow an iprop slave to receive full resyncs from KDCs running
+  krb5-1.10 or earlier.
+
+krb5-1.13.3 changes by ticket ID
+--------------------------------
+
+8031    Document multi-component profile paths
+8173    Supply a hostrealm module to query the registry
+8174    Bump KRB5_MINOR_RELEASE for windows
+8196    Correct CSAIL KDC names
+8197    Fix bindresvport_sa port byte swap bug
+8201    Tolerate null oid pointer in gss_release_oid()
+8204    Fix leak in gss_acquire_cred_with_password
+8209    stale krb5.ini files still cause default realm WIN.MIT.EDU
+8214    Fix uncommon null dereference in PKINIT client
+8223    Uncommon memory leak of err_padata in krb5_init_creds_step()
+8229    Do not allow stream socket retries in libkrad
+8232    Fix gss_inquire_name() name_is_MN result
+8238    Check for null name_type in gss_display_name_ext
+8239    Fix krb5_rd_req() memory leak
+8240    Fix error handling in gss_export_sec_context()
+8241    Fix KDC client referrals
+8282    SPNEGO and IAKERB context aliasing bugs [CVE-2015-2695][CVE-2015-2696]
+8283    Fix build_principal memory bug [CVE-2015-2697]
+8284    Fix IAKERB context export/import [CVE-2015-2698]
+8285    Fix mechglue gss_acquire_cred_impersonate_name
+8286    Fix compatibility with pre-1.11 iprop dump files
+8287    Remove ksu -D flag documentation
+8288    Untabify kerberos.schema and kerberos.ldif
+8289    Fix error mappings for IOV MIC mechglue funcs
+8290    Fix minor utf8-to-ucs2s read overrun bug
+8291    Define error status GSS_S_BAD_MIC
+8292    Fix typo in GSS_S_UNAUTHORIZED error message
+8293    Fix gss_inquire_names_for_mech() on MS krb5 mech
+8294    Check output params on GSS OID set functions
+
+
 Major changes in 1.13.2 (2015-05-08)
 ------------------------------------
 
@@ -398,12 +449,14 @@ reports, suggestions, and valuable resources:
     David Bantz
     Alex Baule
     David Benjamin
+    Thomas Bernard
     Adam Bernstein
     Arlene Berry
     Jeff Blaine
     Radoslav Bodo
     Sumit Bose
     Emmanuel Bouillon
+    Philip Brown
     Michael Calmer
     Andrea Campi
     Julien Chaffraix
@@ -416,6 +469,7 @@ reports, suggestions, and valuable resources:
     Kevin Coffman
     Simon Cooper
     Sylvain Cortes
+    Ian Crowther
     Arran Cudbard-Bell
     Jeff D'Angelo
     Nalin Dahyabhai
@@ -437,6 +491,8 @@ reports, suggestions, and valuable resources:
     Ronni Feldt
     Bill Fellows
     JC Ferguson
+    Remi Ferrand
+    Paul Fertser
     William Fiveash
     Ákos Frohner
     Sebastian Galiano
@@ -505,6 +561,7 @@ reports, suggestions, and valuable resources:
     Mark Phalan
     Brett Randall
     Jonathan Reams
+    Jonathan Reed
     Robert Relyea
     Martin Rex
     Jason Rogers
@@ -539,6 +596,7 @@ reports, suggestions, and valuable resources:
     Ross Wilper
     Augustin Wolf
     David Woodhouse
+    Tsu-Phong Wu
     Xu Qiang
     Neng Xue
     Nickolai Zeldovich

diff --git a/src/man/k5identity.man b/src/man/k5identity.man
index 8ec9a62657d102a84aaee03efcc717be4ec86f13..e3acf8b8cac4a3560036c888724c711e39852a3f 100644 (file)
--- a/src/man/k5identity.man
+++ b/src/man/k5identity.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5IDENTITY" "5" " " "1.13.2" "MIT Kerberos"
+.TH "K5IDENTITY" "5" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 k5identity \- Kerberos V5 client principal selection rules
 .

diff --git a/src/man/k5login.man b/src/man/k5login.man
index 81035bea7a93fb9b5883f989afc374898c493689..fa40bf3767ad652a8d3435f07808e7c7b5cf18c7 100644 (file)
--- a/src/man/k5login.man
+++ b/src/man/k5login.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5LOGIN" "5" " " "1.13.2" "MIT Kerberos"
+.TH "K5LOGIN" "5" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 k5login \- Kerberos V5 acl file for host access
 .

diff --git a/src/man/k5srvutil.man b/src/man/k5srvutil.man
index c5bd776652d56ee6a6155283f69d8b275306d30f..0f53717da185ca7ce57c4a21fe4a036ee32169a4 100644 (file)
--- a/src/man/k5srvutil.man
+++ b/src/man/k5srvutil.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "K5SRVUTIL" "1" " " "1.13.2" "MIT Kerberos"
+.TH "K5SRVUTIL" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 k5srvutil \- host key table (keytab) manipulation utility
 .

diff --git a/src/man/kadm5.acl.man b/src/man/kadm5.acl.man
index e435b796a73963d47064e12d3346b9ce16075598..c5cd3103071317f8b887d0aa386145f843fc899d 100644 (file)
--- a/src/man/kadm5.acl.man
+++ b/src/man/kadm5.acl.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADM5.ACL" "5" " " "1.13.2" "MIT Kerberos"
+.TH "KADM5.ACL" "5" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kadm5.acl \- Kerberos ACL file
 .

diff --git a/src/man/kadmin.man b/src/man/kadmin.man
index f46cc11eafe0e1b64ca8d0ed6a8f2e945af121ad..52a9118cc6c7ce1144feaee6cbe754ff560d5ede 100644 (file)
--- a/src/man/kadmin.man
+++ b/src/man/kadmin.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADMIN" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KADMIN" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kadmin \- Kerberos V5 database administration program
 .

diff --git a/src/man/kadmind.man b/src/man/kadmind.man
index 75dbb68af9a91a1fd3955bec5db8c7c7458cfe01..2c6d36453d86b0e729f7fe9b66965f16ea609628 100644 (file)
--- a/src/man/kadmind.man
+++ b/src/man/kadmind.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KADMIND" "8" " " "1.13.2" "MIT Kerberos"
+.TH "KADMIND" "8" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kadmind \- KADM5 administration server
 .

diff --git a/src/man/kdb5_ldap_util.man b/src/man/kdb5_ldap_util.man
index 06a76122fb6e44360ddd74ec5e99c710af3397fc..70504012108ac072193634e4546b75b20b421ba2 100644 (file)
--- a/src/man/kdb5_ldap_util.man
+++ b/src/man/kdb5_ldap_util.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDB5_LDAP_UTIL" "8" " " "1.13.2" "MIT Kerberos"
+.TH "KDB5_LDAP_UTIL" "8" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kdb5_ldap_util \- Kerberos configuration utility
 .

diff --git a/src/man/kdb5_util.man b/src/man/kdb5_util.man
index bde9ad45dbccec4242ec7e5e9dd90f5e163b6dde..c7adfcf8eaf02b63c43fd119228fd94187a56061 100644 (file)
--- a/src/man/kdb5_util.man
+++ b/src/man/kdb5_util.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDB5_UTIL" "8" " " "1.13.2" "MIT Kerberos"
+.TH "KDB5_UTIL" "8" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kdb5_util \- Kerberos database maintenance utility
 .

diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man
index 7a7e6a2a36b3509c47ac4dfd65e5f07b30e9e522..d1fb3b8cdea3a1c9fa9d7b85e427c9c6cb655c9b 100644 (file)
--- a/src/man/kdc.conf.man
+++ b/src/man/kdc.conf.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDC.CONF" "5" " " "1.13.2" "MIT Kerberos"
+.TH "KDC.CONF" "5" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kdc.conf \- Kerberos V5 KDC configuration file
 .

diff --git a/src/man/kdestroy.man b/src/man/kdestroy.man
index eb0116987551544470d533572635d20df6090816..d8d08e80b6c07b79f9b88486f0c1ca0376f5cb89 100644 (file)
--- a/src/man/kdestroy.man
+++ b/src/man/kdestroy.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KDESTROY" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KDESTROY" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kdestroy \- destroy Kerberos tickets
 .

diff --git a/src/man/kinit.man b/src/man/kinit.man
index 36480acbecd17cd1331aa2b3d77620fd937ba50d..af0412704ddcb620b0ffa7f9e63506a2eac85ebb 100644 (file)
--- a/src/man/kinit.man
+++ b/src/man/kinit.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KINIT" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KINIT" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kinit \- obtain and cache Kerberos ticket-granting ticket
 .

diff --git a/src/man/klist.man b/src/man/klist.man
index 6d5770e2faf3c62d58c3caa00041ad4502e855d4..bca460f70791e0b2b455f11919ab757c17b6cce6 100644 (file)
--- a/src/man/klist.man
+++ b/src/man/klist.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KLIST" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KLIST" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 klist \- list cached Kerberos tickets
 .

diff --git a/src/man/kpasswd.man b/src/man/kpasswd.man
index befe9cc770bc7dc5c6fbb99292d4ad2cc799ab05..c4b7c3801ceb372957e6d7fcac532c1cb1c24042 100644 (file)
--- a/src/man/kpasswd.man
+++ b/src/man/kpasswd.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPASSWD" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KPASSWD" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kpasswd \- change a user's Kerberos password
 .

diff --git a/src/man/kprop.man b/src/man/kprop.man
index f57c132d7b3bf4838fe6cdc585559902f401b16a..d4970e0faef6a5d00f0d69392aa21223f748a589 100644 (file)
--- a/src/man/kprop.man
+++ b/src/man/kprop.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROP" "8" " " "1.13.2" "MIT Kerberos"
+.TH "KPROP" "8" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kprop \- propagate a Kerberos V5 principal database to a slave server
 .

diff --git a/src/man/kpropd.man b/src/man/kpropd.man
index f157f92cd5d1e37fa0e6a0982c721d3ea87343c8..255959069c0346b74cafabe5ce4c7e9aa2ee14f2 100644 (file)
--- a/src/man/kpropd.man
+++ b/src/man/kpropd.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROPD" "8" " " "1.13.2" "MIT Kerberos"
+.TH "KPROPD" "8" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kpropd \- Kerberos V5 slave KDC update server
 .

diff --git a/src/man/kproplog.man b/src/man/kproplog.man
index 10b042337dd5720bfda5490bda72ed0cd49c598e..c9418b543ab7db3c3f38c886c7ddf1122aadaa7e 100644 (file)
--- a/src/man/kproplog.man
+++ b/src/man/kproplog.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KPROPLOG" "8" " " "1.13.2" "MIT Kerberos"
+.TH "KPROPLOG" "8" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kproplog \- display the contents of the Kerberos principal update log
 .

diff --git a/src/man/krb5-config.man b/src/man/krb5-config.man
index 52086dbe037e8a376755b452d96437487ad11921..fa72a55029ca7a12f980bde314fd7c004d6c14b8 100644 (file)
--- a/src/man/krb5-config.man
+++ b/src/man/krb5-config.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5-CONFIG" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KRB5-CONFIG" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 krb5-config \- tool for linking against MIT Kerberos libraries
 .

diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
index 495ecd1b532c8ae3789f05878f6cd60798621deb..4abe1b0d1f71722362bd26cb0ecb2c6a58f01564 100644 (file)
--- a/src/man/krb5.conf.man
+++ b/src/man/krb5.conf.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5.CONF" "5" " " "1.13.2" "MIT Kerberos"
+.TH "KRB5.CONF" "5" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 krb5.conf \- Kerberos configuration file
 .

diff --git a/src/man/krb5kdc.man b/src/man/krb5kdc.man
index 79d9a6103cd4b09985083287d09d723b6b210660..bbea3477911723268879df21633f92fd82cc4bfe 100644 (file)
--- a/src/man/krb5kdc.man
+++ b/src/man/krb5kdc.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KRB5KDC" "8" " " "1.13.2" "MIT Kerberos"
+.TH "KRB5KDC" "8" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 krb5kdc \- Kerberos V5 KDC
 .

diff --git a/src/man/ksu.man b/src/man/ksu.man
index c762dd23db06a4a1d35f37d782ac821a582f6a2d..1e3d664c86e128bffc33632c500040dd5cbfe806 100644 (file)
--- a/src/man/ksu.man
+++ b/src/man/ksu.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KSU" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KSU" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 ksu \- Kerberized super-user
 .

diff --git a/src/man/kswitch.man b/src/man/kswitch.man
index 8e736fe21de5afe9d934057d67fdc4673700662b..ae88603472aae50786a513192d2553024ad44d3c 100644 (file)
--- a/src/man/kswitch.man
+++ b/src/man/kswitch.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KSWITCH" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KSWITCH" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kswitch \- switch primary ticket cache
 .

diff --git a/src/man/ktutil.man b/src/man/ktutil.man
index e9ac740503deff68a2183638ddfbeb10d9b6f00e..7b5ff1b289d3ad540e36ef2beb4ac52a4698c7ef 100644 (file)
--- a/src/man/ktutil.man
+++ b/src/man/ktutil.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KTUTIL" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KTUTIL" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 ktutil \- Kerberos keytab file maintenance utility
 .

diff --git a/src/man/kvno.man b/src/man/kvno.man
index cc05cfbff0b73c5899ec66073b13228a5f37b6cc..95582ec192418ea756dec580e4ce98da1e882fdd 100644 (file)
--- a/src/man/kvno.man
+++ b/src/man/kvno.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "KVNO" "1" " " "1.13.2" "MIT Kerberos"
+.TH "KVNO" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 kvno \- print key version numbers of Kerberos principals
 .

diff --git a/src/man/sclient.man b/src/man/sclient.man
index 414afdf5792be8bd2892c72a0c198f3409e94467..6dc1ac4e2cd520d9fec99a658912b3707195375c 100644 (file)
--- a/src/man/sclient.man
+++ b/src/man/sclient.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SCLIENT" "1" " " "1.13.2" "MIT Kerberos"
+.TH "SCLIENT" "1" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 sclient \- sample Kerberos version 5 client
 .

diff --git a/src/man/sserver.man b/src/man/sserver.man
index 845ed0d53e591b33f11c91a563d84536fb4d98cf..3427c975bf22204273c8a5b05a0b8947cd4f5a9c 100644 (file)
--- a/src/man/sserver.man
+++ b/src/man/sserver.man
@@ -1,6 +1,6 @@
 .\" Man page generated from reStructuredText.
 .
-.TH "SSERVER" "8" " " "1.13.2" "MIT Kerberos"
+.TH "SSERVER" "8" " " "1.13.3" "MIT Kerberos"
 .SH NAME
 sserver \- sample Kerberos version 5 server
 .

diff --git a/src/patchlevel.h b/src/patchlevel.h
index 3d9d93636a6e649d2dbb0446e0e8c9ce15b29c7f..7c2cbc99cf8639aa7aaf8e9b221022e16a1e9789 100644 (file)
--- a/src/patchlevel.h
+++ b/src/patchlevel.h
@@ -51,7 +51,7 @@
  */
 #define KRB5_MAJOR_RELEASE 1
 #define KRB5_MINOR_RELEASE 13
-#define KRB5_PATCHLEVEL 2
-#define KRB5_RELTAIL "postrelease"
+#define KRB5_PATCHLEVEL 3
+/* #undef KRB5_RELTAIL */
 /* #undef KRB5_RELDATE */
-#define KRB5_RELTAG "krb5-1.13"
+#define KRB5_RELTAG "krb5-1.13.3-final"

diff --git a/src/po/mit-krb5.pot b/src/po/mit-krb5.pot
index 3e76f30766a7f43ee87be1db5c25f1682080f411..e2106bb18d50d4baffaaa5fd925889aec9168da9 100644 (file)
--- a/src/po/mit-krb5.pot
+++ b/src/po/mit-krb5.pot
@@ -6,9 +6,9 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: mit-krb5 1.13.2-postrelease\n"
+"Project-Id-Version: mit-krb5 1.13.3\n"
 "Report-Msgid-Bugs-To: \n"
-"POT-Creation-Date: 2015-12-02 17:03-0500\n"
+"POT-Creation-Date: 2015-12-03 16:38-0500\n"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
 "Last-Translator: FULL NAME <EMAIL@ADDRESS>\n"
 "Language-Team: LANGUAGE <LL@li.org>\n"