<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="43">
<package pkgid="04ecddc30792d99a2c9788726e363ed756abdbda09e5955884d6bf219aea686ec63c4e223bb34119627bd5fa9172941c0cf9c55d4bbf2d09f311d729b80ef918" name="krb5" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="f98797fd1b426c114ee80391e97d974b77d5f6668fc83db2e5406c11781c317b481c5aac4331aa5c1574fbabbb88cb77854e9913281a0ff68d6e3a057913f18c" name="krb5" arch="src">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="mcepl@suse.com" date="1529323200">- BSC#1021402 move %{_libdir}/krb5/plugins/tls/k5tls.so to krb5 package
  so it is avaiable for krb5-client as well.</changelog>
  <changelog author="James McDonough &lt;jmcdonough@suse.com&gt;" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1557230400">- Move LDAP schema files from /usr/share/doc/packages/krb5 to
  /usr/share/kerberos/ldap; (bsc#1134217);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="4e6501a03c27c3d3f3910113dc71fc1c0a428a7ff4e6a6f9257d2913a438dec3eb47a998e78b5b5556749f031880892fb405591de36b4a677ffbc0d04ef34927" name="krb5" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="e61f153ed29c47ad65af05bbc462cf42e9b40f074caeafee05b461b3e5036fcbcca75423caa2dcd2a9bdc8c2ca493f077192aa60106f8a549bbc9c07806433a1" name="krb5-32bit" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="3ae1f4709b81d870475638106cbc328eee2485e0b7fdbfedb3b1e68583fe85e808eef7ad3fb03dfa2d12106b1d45f98593e98c03415ed3e5743451a720602f8e" name="krb5-client" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="bb51890a47faab2da35e98d8b1b0c4e1ac4bb554bd3c975cc6fc94c4ca385d0aa2e79382079ac4e4bd1e5c60c039d33be511a0123957b6f02774ef1bc17bd916" name="krb5-client" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="6fcc573f6dd5d840a9b8087640d8a7885218c26d5b4ed505635b7e92555bf533b862a502587774adc00e581579c621b8c86b48d8154b0f474f04538925ec5273" name="krb5-devel" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="f1c4ec577fbe0a456452cc79ef7e3f0c90bae8e2ce256b0492a67ee5429286934b88e78c6ddb069cf9d710ef9c45aeeeee4cfbd65e84d7326541d44e9df3f5fb" name="krb5-devel" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="aad1efd9208fde729da56f7cd71866fc36973e58d2be636940881bf5bfe17846e8190c235d274ac78049f9275649ad3e5127cdca4857823a8d4445054fd0854d" name="krb5-devel-32bit" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="6e218489609ca48c28405cf83c680ec967aa5e30464619de6d903c6b50e42bd50976c2fe0bc85aaa1afc12a53bc409483662b59344fbde637580e8ac6676f7db" name="krb5-mini" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.20"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="7245cfe7a5a35650e0fe3ccaec03ae81ac4698d7ecc7e2f1bbf5565ea039ee1d5fedcd07773fbf88579812da35c5d1f82776f9cf2309986cd1a28508ada301ca" name="krb5-mini" arch="src">
  <version epoch="0" ver="1.21.2" rel="14.20"/>
  <changelog author="rbrown@suse.com" date="1511438400">- Replace references to /var/adm/fillup-templates with new
  %_fillupdir macro (boo#1069468)</changelog>
  <changelog author="luizluca@gmail.com" date="1524657600">- Added support for /etc/krb5.conf.d/ for configuration snippets</changelog>
  <changelog author="michael@stroeder.com" date="1525435200">- Upgrade to 1.15.3
  * Fix flaws in LDAP DN checking, including a null dereference KDC
    crash which could be triggered by kadmin clients with administrative
    privileges [CVE-2018-5729, CVE-2018-5730].
  * Fix a KDC PKINIT memory leak.
  * Fix a small KDC memory leak on transited or authdata errors when
    processing TGS requests.
  * Fix a null dereference when the KDC sends a large TGS reply.
  * Fix "kdestroy -A" with the KCM credential cache type.
  * Fix the handling of capaths "." values.
  * Fix handling of repeated subsection specifications in profile files
    (such as when multiple included files specify relations in the same
    subsection).</changelog>
  <changelog author="James McDonough &lt;jmcdonough@suse.com&gt;" date="1539086400">- Upgrade to 1.16.1
  * kdc client cert matching on client principal entry
  * Allow ktutil addent command to ignore key version and use
    non-default salt string.
  * add kpropd pidfile support
  * enable "encrypted_challenge_indicator" realm option on tickets
    obtained using FAST encrypted challenge pre-authentication.
  * dates through 2106 accepted
  * KDC support for trivially renewable tickets
  * stop caching referral and alternate cross-realm TGTs to prevent
    duplicate credential cache entries</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1548849600">- Upgrade to 1.16.3
  * Fix a regression in the MEMORY credential cache type which could cause
    client programs to crash.
  * MEMORY credential caches will not be listed in the global collection,
    with the exception of the default credential cache if it is of type MEMORY.
  * Remove an incorrect assertion in the KDC which could be used to cause
    a crash [CVE-2018-20217].
  * Fix bugs with concurrent use of MEMORY ccache handles.
  * Fix a KDC crash when falling back between multiple OTP tokens configured
    for a principal entry.
  * Fix memory bugs when gss_add_cred() is used to create a new credential,
    and fix a bug where it ignores the desired_name.
  * Fix the behavior of gss_inquire_cred_by_mech() when the credential does
    not contain an element of the requested mechanism.
  * Make cross-realm S4U2Self requests work on the client when no
    default_realm is configured.
  * Add a kerberos(7) man page containing documentation of the environment
    variables that affect Kerberos programs.
- Use systemd-tmpfiles to create files under /var/lib/kerberos, required
  by transactional updates; (bsc#1100126);
- Rename patches:
  * krb5-1.12-pam.patch =&gt; 0001-krb5-1.12-pam.patch
  * krb5-1.9-manpaths.dif =&gt; 0002-krb5-1.9-manpaths.patch
  * krb5-1.12-buildconf.patch =&gt; 0003-krb5-1.12-buildconf.patch
  * krb5-1.6.3-gssapi_improve_errormessages.dif to
    0004-krb5-1.6.3-gssapi_improve_errormessages.patch
  * krb5-1.6.3-ktutil-manpage.dif =&gt; 0005-krb5-1.6.3-ktutil-manpage.patch
  * krb5-1.12-api.patch =&gt; 0006-krb5-1.12-api.patch
  * krb5-1.12-ksu-path.patch =&gt; 0007-krb5-1.12-ksu-path.patch
  * krb5-1.12-selinux-label.patch =&gt;  0008-krb5-1.12-selinux-label.patch
  * krb5-1.9-debuginfo.patch =&gt; 0009-krb5-1.9-debuginfo.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1565006400">- Integrate pam_keyinit pam module, ksu-pam.d; (bsc#1081947);
  (bsc#1144047);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1591617600">- Update logrotate script, call systemd to reload the services
  instead of init-scripts. (boo#1169357)</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1595851200">- Fix prefix reported by krb5-config, libraries and headers are not
  installed under /usr/lib/mit prefix. (bsc#1174079)</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1604923200">- Add recursion limit for ASN.1 indefinite lengths; (CVE-2020-28196);
  (bsc#1178512);
- Added patches:
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1619092800">- Use /run instead of /var/run for daemon PID files; (bsc#1185163);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="3d5624ed1d8b01db005df6a1f55639597c60fe18b5b81d432ec036e69012e8ddbea9326c32c5aed28ade4b3bd128cd20882c952cb817fa47cf006a59b113af89" name="krb5-mini" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.20"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="816fd1eeddc5889078b25498203a508312d1d365a8ba3fc9f25ed6c0655cb829d28c666d3c01b8086fb2bb855e06b848c032971ad6845da2ad78c3fafc028fff" name="krb5-mini-devel" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.20"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="96e9e39811c7d7e39219637fc3844c901f9dadf27fea4a1c0df608eb26a0972b87853e17c3be8b1802f2eb7ab51b359e17c343f8802c6ca66f8e80d0594faca7" name="krb5-mini-devel" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.20"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="56f93c2d7e00c8966ea860eff4656eabfb35a0a42efd99c46727d0c14e232f113f0a20356fa3ebda63e3863020aaf0b0b69697a617d7d2182effea58edd78da4" name="krb5-plugin-kdb-ldap" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="d34fd8db52a4d46ff05c0fd28dcd85f4525834e8a3ecfbbff66915b2cd1b84d30acbcb28f9cc51185006cbcd4f9ce7448d010896b2c78f733b1bc1097d9f4f06" name="krb5-plugin-kdb-ldap" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="2ffb72446677467f286e5f8e031d1c4cba4d130da140fe011c2b6dab4deae00a6f81cee9b25d475a7d9e230914ecbe6da8a4ab75e31eb28c26e657161192b8a8" name="krb5-plugin-preauth-otp" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="e1aaf32b1b3bf55497ac378b261e43f2849c21d24eb58bb50984806180e38724866790b6c22e61145f78a1dd47d283e4fe70a6696d534d13b549b528243bd7aa" name="krb5-plugin-preauth-otp" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="26d6ee1bccb1c38cc359fed7fb7e78a7dca706c46a857e2c556a364be6ffe9144470747ce87c0f7a2035ce8f8380217d1f43a9f05c04d15be9e3328b0a4fbcc7" name="krb5-plugin-preauth-pkinit" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="1c664722b6655738e00cb56e9739b7dccc1ab18d9bb5b7ed70650339dd81df7a5090b36f01826cd5556623716135b4fc2c74c9f65747b428d6606e3bbe30abdc" name="krb5-plugin-preauth-pkinit" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="2bf624987bce68e8f13fd57ca19a398459646fbbf7d1725cc962aa65d61ddf353e07a59e1beb539c2493df711aa96f1066fdc76395ddfe31ac404eddba26552f" name="krb5-plugin-preauth-spake" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="cc31e072b39bbc6a9f81efc7e82bb192540e93af10a6d346c8a0e8c002ba88dada48143003279e87c6031cd6fe5a71d86913c2ee955c5c4b962993855bae55a7" name="krb5-plugin-preauth-spake" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="adb04d9fab7ce14920dbb8cb7f12ff50bff181714108fa8cabda9637cdeaeebc003a5cb4a2a3388686f52a3dd915e06d7215cfd9dcaf1a34ea6dd96058b82544" name="krb5-server" arch="i586">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="b4a73b5168e06602b26dc337a53641f4f6da2820b91a922d8e300b71f91aec2f5163aaa70eca81384c682121d2f6b82ec2f2736baab8d80df27161c7f23265fc" name="krb5-server" arch="x86_64">
  <version epoch="0" ver="1.21.2" rel="14.21"/>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1627300800">- Fix KDC null deref on bad encrypted challenge; (CVE-2021-36222);
  (bsc#1188571);
- Added patches:
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1630324800">- Fix KDC null pointer dereference via a FAST inner body that
  lacks a server field; (CVE-2021-37750); (bsc#1189929);
- Added patches:
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 1.19.2
  * Fix a denial of service attack against the KDC encrypted challenge
    code; (CVE-2021-36222);
  * Fix a memory leak when gss_inquire_cred() is called without a
    credential handle.
- Changes from 1.19.1
  * Fix a linking issue with Samba.
  * Better support multiple pkinit_identities values by checking whether
    certificates can be loaded for each value.
- Changes from 1.19
  Administrator experience
  * When a client keytab is present, the GSSAPI krb5 mech will refresh
    credentials even if the current credentials were acquired manually.
  * It is now harder to accidentally delete the K/M entry from a KDB.
  Developer experience
  * gss_acquire_cred_from() now supports the "password" and "verify"
    options, allowing credentials to be acquired via password and
    verified using a keytab key.
  * When an application accepts a GSS security context, the new
    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor
    both provided matching channel bindings.
  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests
    to identify the desired client principal by certificate.
  * PKINIT certauth modules can now cause the hw-authent flag to be set
    in issued tickets.
  * The krb5_init_creds_step() API will now issue the same password
    expiration warnings as krb5_get_init_creds_password().
  Protocol evolution
  * Added client and KDC support for Microsoft's Resource-Based Constrained
    Delegation, which allows cross-realm S4U2Proxy requests. A third-party
    database module is required for KDC support.
  * kadmin/admin is now the preferred server principal name for kadmin
    connections, and the host-based form is no longer created by default.
    The client will still try the host-based form as a fallback.
  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT
    extension, which causes channel bindings to be required for the
    initiator if the acceptor provided them. The client will send this
    option if the client_aware_gss_bindings profile option is set.
  User experience
  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is
    used in the reply. This encryption type will be deprecated and removed
    in future releases.
  * Added kvno flags --out-cache, --no-store, and --cached-only
    (inspired by Heimdal's kgetcred).
- Changes from 1.18.3
  * Fix a denial of service vulnerability when decoding Kerberos
    protocol messages; (CVE-2020-28196); (bsc#1178512);
  * Fix a locking issue with the LMDB KDB module which could cause
    KDC and kadmind processes to lose access to the database.
  * Fix an assertion failure when libgssapi_krb5 is repeatedly loaded
    and unloaded while libkrb5support remains loaded.
- Changes from 1.18.2
  * Fix a SPNEGO regression where an acceptor using the default credential
    would improperly filter mechanisms, causing a negotiation failure.
  * Fix a bug where the KDC would fail to issue tickets if the local krbtgt
    principal's first key has a single-DES enctype.
  * Add stub functions to allow old versions of OpenSSL libcrypto to link
    against libkrb5.
  * Fix a NegoEx bug where the client name and delegated credential might
    not be reported.
- Changes from 1.18.1
  * Fix a crash when qualifying short hostnames when the system has
    no primary DNS domain.
  * Fix a regression when an application imports "service@" as a GSS
    host-based name for its acceptor credential handle.
  * Fix KDC enforcement of auth indicators when they are modified by
    the KDB module.
  * Fix removal of require_auth string attributes when the LDAP KDB
    module is used.
  * Fix a compile error when building with musl libc on Linux.
  * Fix a compile error when building with gcc 4.x.
  * Change the KDC constrained delegation precedence order for consistency
    with Windows KDCs.
- Changes from 1.18
  Administrator experience:
  * Remove support for single-DES encryption types.
  * Change the replay cache format to be more efficient and robust.
    Replay cache filenames using the new format end with ".rcache2"
    by default.
  * setuid programs will automatically ignore environment variables
    that normally affect krb5 API functions, even if the caller does
    not use krb5_init_secure_context().
  * Add an "enforce_ok_as_delegate" krb5.conf relation to disable
    credential forwarding during GSSAPI authentication unless the KDC
    sets the ok-as-delegate bit in the service ticket.
  * Use the permitted_enctypes krb5.conf setting as the default value
    for default_tkt_enctypes and default_tgs_enctypes.
  Developer experience:
  * Implement krb5_cc_remove_cred() for all credential cache types.
  * Add the krb5_pac_get_client_info() API to get the client account
    name from a PAC.
  Protocol evolution:
  * Add KDC support for S4U2Self requests where the user is identified
    by X.509 certificate. (Requires support for certificate lookup from
    a third-party KDB module.)
  * Remove support for an old ("draft 9") variant of PKINIT.
  * Add support for Microsoft NegoEx. (Requires one or more third-party
    GSS modules implementing NegoEx mechanisms.)
  User experience:
  * Add support for "dns_canonicalize_hostname=fallback", causing
    host-based principal names to be tried first without DNS
    canonicalization, and again with DNS canonicalization if the
    un-canonicalized server is not found.
  * Expand single-component hostnames in host-based principal names
    when DNS canonicalization is not used, adding the system's first DNS
    search path as a suffix. Add a "qualify_shortname" krb5.conf relation
    to override this suffix or disable expansion.
  * Honor the transited-policy-checked ticket flag on application servers,
    eliminating the requirement to configure capaths on servers in some
    scenarios.
  Code quality:
  * The libkrb5 serialization code (used to export and import krb5 GSS
    security contexts) has been simplified and made type-safe.
  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED
    messages has been revised to conform to current coding practices.
  * The test suite has been modified to work with macOS System Integrity
    Protection enabled.
  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support
    can always be tested.
- Changes from 1.17.1
  * Fix a bug preventing "addprinc -randkey -kvno" from working in kadmin.
  * Fix a bug preventing time skew correction from working when a KCM
    credential cache is used.
- Changes from 1.17:
  Administrator experience:
  * A new Kerberos database module using the Lightning Memory-Mapped
    Database library (LMDB) has been added.  The LMDB KDB module should
    be more performant and more robust than the DB2 module, and may
    become the default module for new databases in a future release.
  * "kdb5_util dump" will no longer dump policy entries when specific
    principal names are requested.
  Developer experience:
  * The new krb5_get_etype_info() API can be used to retrieve enctype,
    salt, and string-to-key parameters from the KDC for a client
    principal.
  * The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise
    principal names to be used with GSS-API functions.
  * KDC and kadmind modules which call com_err() will now write to the
    log file in a format more consistent with other log messages.
  * Programs which use large numbers of memory credential caches should
    perform better.
  Protocol evolution:
  * The SPAKE pre-authentication mechanism is now supported.  This
    mechanism protects against password dictionary attacks without
    requiring any additional infrastructure such as certificates.  SPAKE
    is enabled by default on clients, but must be manually enabled on
    the KDC for this release.
  * PKINIT freshness tokens are now supported.  Freshness tokens can
    protect against scenarios where an attacker uses temporary access to
    a smart card to generate authentication requests for the future.
  * Password change operations now prefer TCP over UDP, to avoid
    spurious error messages about replays when a response packet is
    dropped.
  * The KDC now supports cross-realm S4U2Self requests when used with a
    third-party KDB module such as Samba's.  The client code for
    cross-realm S4U2Self requests is also now more robust
    (CVE-2018-20217).
  User experience:
  * The new ktutil addent -f flag can be used to fetch salt information
    from the KDC for password-based keys.
  * The new kdestroy -p option can be used to destroy a credential cache
    within a collection by client principal name.
  * The Kerberos man page has been restored, and documents the
    environment variables that affect programs using the Kerberos
    library.
  Code quality:
  * Python test scripts now use Python 3.
  * Python test scripts now display markers in verbose output, making it
    easier to find where a failure occurred within the scripts.
  * The Windows build system has been simplified and updated to work
    with more recent versions of Visual Studio.  A large volume of
    unused Windows-specific code has been removed.  Visual Studio 2013
    or later is now required.
- Replace old $RPM_* shell vars
- Removal of SuSEfirewall2 service since SuSEfirewall2 has been replaced
  by firewalld
- Remove cruft to support distributions older than SLE 12
- Use macros where applicable
- Switch to pkgconfig style dependencies
- Use %_tmpfilesdir instead of the wrong %_libexecdir/tmpfiles.d
  notation: libexecdir is likely changing away from /usr/lib to
  /usr/libexec
- Build with full Cyrus SASL support. Negotiating SASL credentials with
  an EXTERNAL bind mechanism requires interaction. Kerberos provides its
  own interaction function that skips all interaction, thus preventing the
  mechanism from working.
- Removed patches:
  * 0007-krb5-1.12-ksu-path.patch
  * 0010-Add-recursion-limit-for-ASN.1-indefinite-lengths.patch
  * 0011-Fix-KDC-null-deref-on-bad-encrypted-challenge.patch
- Renamed patches:
  * 0001-krb5-1.12-pam.patch =&gt; 0001-ksu-pam-integration.patch
  * 0003-krb5-1.12-buildconf.patch =&gt; 0003-Adjust-build-configuration.patch
  * 0008-krb5-1.12-selinux-label.patch =&gt; 0007-SELinux-integration.patch
  * 0009-krb5-1.9-debuginfo.patch =&gt; 0008-krb5-1.9-debuginfo.patch
  * 0012-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch =&gt;
    0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1667822400">- Fix integer overflows in PAC parsing; (CVE-2022-42898);
  (bso#15203), (bsc#1205126).
- Added patches:
  * 0010-Fix-integer-overflows-in-PAC-parsing.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1670932800">- Update to 1.20.1; (bsc#1205126); (CVE-2022-42898);
  * Fix integer overflows in PAC parsing [CVE-2022-42898].
  * Fix null deref in KDC when decoding invalid NDR.
  * Fix memory leak in OTP kdcpreauth module.
  * Fix PKCS11 module path search.
- update to 1.20.0:
  * Added a "disable_pac" realm relation to suppress adding PAC authdata
    to tickets, for realms which do not need to support S4U requests.
  * Most credential cache types will use atomic replacement when a cache
    is reinitialized using kinit or refreshed from the client keytab.
  * kprop can now propagate databases with a dump size larger than 4GB,
    if both the client and server are upgraded.
  * kprop can now work over NATs that change the destination IP address,
    if the client is upgraded.
  * Updated the KDB interface.  The sign_authdata() method is replaced
    with the issue_pac() method, allowing KDB modules to add logon info
    and other buffers to the PAC issued by the KDC.
  * Host-based initiator names are better supported in the GSS krb5
    mechanism.
  * Replaced AD-SIGNEDPATH authdata with minimal PACs.
  * To avoid spurious replay errors, password change requests will not
    be attempted over UDP until the attempt over TCP fails.
  * PKINIT will sign its CMS messages with SHA-256 instead of SHA-1.
  * Updated all code using OpenSSL to be compatible with OpenSSL 3.
  * Reorganized the libk5crypto build system to allow the OpenSSL
    back-end to pull in material from the builtin back-end depending on
    the OpenSSL version.
  * Simplified the PRNG logic to always use the platform PRNG.
  * Converted the remaining Tcl tests to Python.
- update to 1.19.3 (bsc#1189929, CVE-2021-37750):
  * Fix a denial of service attack against the KDC [CVE-2021-37750].
  * Fix KDC null deref on TGS inner body null server
  * Fix conformance issue in GSSAPI tests
- Resolve "Credential cache directory /run/user/0/krb5cc does not
  exist while opening default credentials cache" by using a kernel
  keyring instead of a dir cache; (bsc#1109830);
- Added hardening to systemd services; (bsc#1181400);
- Drop 0009-Fix-KDC-null-deref-on-TGS-inner-body-null-server.patch,
  fixed in release 1.20.0
- Drop 0010-Fix-integer-overflows-in-PAC-parsing.patch,
  fixed in release 1.20.1</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1691496000">- Ensure array count consistency in kadm5 RPC; (bsc#1214054);
  (CVE-2023-36054);
- Added patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1694520000">- Avoid KDC spoofing vulnerability, enable verify_ap_req_nofail in
  krb5.conf; (jsc#PED-6213);</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1701172800">- Update patch 0007-SELinux-integration.patch for SELinux 3.5</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1711108800">- Fix memory leaks, add patch 0010-Fix-three-memory-leaks.patch
  * CVE-2024-26458, bsc#1220770
  * CVE-2024-26461, bsc#1220771
  * CVE-2024-26462, bsc#1220772</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1719144000">- Update to 1.21.2
  * CVE-2023-39975, Fix double-free in KDC TGS processing
- Update to 1.21.1
  * CVE-2023-36054, Fix potential uninitialized pointer free in
    kadm5 XDR parsing
- Update to 1.21
  * Added a credential cache type providing compatibility with the
    macOS 11 native credential cache.
  * libkadm5 will use the provided krb5_context object to read
    configuration values, instead of creating its own.
  * Added an interface to retrieve the ticket session key from a GSS
    context.
  * The KDC will no longer issue tickets with RC4 or triple-DES
    session keys unless explicitly configured with the new allow_rc4
    or allow_des3 variables respectively.
  * The KDC will assume that all services can handle aes256-sha1
    session keys unless the service principal has a session_enctypes
    string attribute.
  * Support for PAC full KDC checksums has been added to mitigate
    an S4U2Proxy privilege escalation attack.
  * The PKINIT client will advertise a more modern set of supported
    CMS algorithms.
  * Removed unused code in libkrb5, libkrb5support, and the PKINIT
    module.
  * Modernized the KDC code for processing TGS requests, the code
    for encrypting and decrypting key data, the PAC handling code,
    and the GSS library packet parsing and composition code.
  * Improved the test framework's detection of memory errors in
    daemon processes when used with asan.
- Removed patches:
  * 0009-Ensure-array-count-consistency-in-kadm5-RPC.patch</changelog>
</package>
<package pkgid="a105693754475afd1044f3545461b9762e039d0b3df07546f34df516c60d5ec7fca60ffccbb3c90f651d504e6afc444df1446d4296f267a0873cb1b9988f7f9f" name="libpython3_6m1_0" arch="i586">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="51ecfa11a417cba7d758a8a5c5593f1d750ee6abfc0559263598e97cac1a256bc85350018a3273039531557c1186178c3a0296197ba982f0e2b348cf1f0edaee" name="libpython3_6m1_0" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="11e2d7ea4e6fe9935e930c5191eff0ade8ff6eb8d2c81906f9c815fa4421d68c10e095be940dc79d4f6e4be9888d742032fe6f6854d6f38c85f79d5ee65cc10e" name="libpython3_6m1_0-32bit" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="d711596f3560b9f401f4a42766aec20b2bead33ff56c8500286bf6abbd2bd8a3da586eb0f77772f0d6ce6211039963cf46a8014dedbe43345ddc5f33e8df7b9f" name="python3-base" arch="i586">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="e171bb3c99428f521da23c290f3fd1718042d309cb36f2abf5a57712cb97cc429265b331d9b186b1a3a960da0b1202286031bca6232d7471d4df18cef7844fe8" name="python3-base" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="494ca52c598eb0e836e26fd613dd81bcf335abddd6ca7db2804099fda93dc72d732b319320beeed194ed9f6fc9f4ca2969841cba821f6f29427721cc549dadef" name="python3-base-32bit" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="9e5ccd594ae395f43c43030cbc05ab174e55ac184bba8cb873fe15e9270326b7895338a7faf2f29f90211b9419aa886e55a0f60b4ba931dc4c27ac149abbde9f" name="python3-core" arch="src">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="21c3bab244d0600be89b03faab537e2e01b40c1e6e6780b390c092739cb9db7a9a68f9c8035f5b0614edcb4561b32fe0f24e19c6f094aedc7af2a94a2c42222f" name="python3-devel" arch="i586">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="161c9af3aae03f5acf3ed18fde85d3b05d5117e266d26c57bc2a444a7ac0d3a546487b334ce6bd75c7241876a510ab06497690b2ae4ff3590dd3efb03aff2832" name="python3-devel" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="53e6e6e243e2c02ef41c67d30c364f8958aaa8d1dd43e6d55b0297ee445d328b2bac497354711ed406b7f7f561159b04c99cbc8e4f2fb07acb520bbc98117ae9" name="python3-testsuite" arch="i586">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="c6012570318ade78bc30292c45296a4c4f67765899ce19971b035f6aef4f731f2387950ebe20670a95bc4133e8a3be0c72892870007b796f2c47b29a00f91981" name="python3-testsuite" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="06f7c6045d0baad8926ca421fd1291d5ac915e109d927a9da23f31e7fff68eb1dcca5810700f593e88469e4beb6cd24ba4716f4f952e9a839c8e25f8a8c04f67" name="python3-tools" arch="i586">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="0644b1494f61b4f098b19cf8b4b3a0df41fd47f74a39bb91347cdcdcfda91eb4fc4a9716f0557c706bb81dd2a969a4e07e86b6cff794f5220c41edfb883bb58c" name="python3-tools" arch="x86_64">
  <version epoch="0" ver="3.6.15" rel="1.134"/>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1599048000">- Add faulthandler_stack_overflow_on_GCC10.patch to make build
  working even with GCC10 (bpo#38965).</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1601035200">- Buildrequire timezone only for general flavor. It's used in this
  flavor for the test suite.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1602244800">- Fix installing .desktop file</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602244801">- Fix build with RPM 4.16: error: bare words are no longer
  supported, please use "...":  x86 == ppc.</changelog>
  <changelog author="Marketa Calabkova &lt;mcalabkova@suse.com&gt;" date="1602590400">- Handful of changes to make python36 compatible with SLE15 and SLE12
  (jsc#ECO-2799, jsc#SLE-13738)
- Rebase bpo23395-PyErr_SetInterrupt-signal.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606219200">- Replace bundled wheels for pip and setuptools with the updated ones
  (bsc#1176262 CVE-2019-20916).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606305600">- Change setuptools and pip version numbers according to new
  wheels (bsc#1179756).
- Add ignore_pip_deprec_warn.patch to switch of persistently
  failing test.</changelog>
  <changelog author="Mark&#xE9;ta Machov&#xE1; &lt;mmachova@suse.com&gt;" date="1606478400">- Pin Sphinx version to fix doc subpackage</changelog>
  <changelog author="Steve Kowalik &lt;steven.kowalik@suse.com&gt;" date="1606824000">- Add patch sphinx-update-removed-function.patch to no longer call
  a now removed function (gh#python/cpython#13236). As
  a consequence, no longer pin Sphinx version.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1606824001">- Add CVE-2020-27619-no-eval-http-content.patch fixing
  CVE-2020-27619 (bsc#1178009), where Lib/test/multibytecodec_support
  calls eval() on content retrieved via HTTP.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607169600">- (bsc#1179630) Update sphinx-update-removed-function.patch to
  work with all versions of Sphinx (not binding the Python
  documentation build to the latest verison of Sphinx). Updated
  version mentioned on gh#python/cpython#13236.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1607342400">- Adjust sphinx-update-removed-function.patch</changelog>
  <changelog author="Marcus Meissner &lt;meissner@suse.com&gt;" date="1609156800">- readd --with-fpectl (bsc#1180377)</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611748800">- Provide the newest setuptools wheel (bsc#1176262,
  CVE-2019-20916) in their correct form (bsc#1180686).</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1611921600">- Add CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch fixing
  bsc#1181126 (CVE-2021-3177) buffer overflow in PyCArg_repr in
  _ctypes/callproc.c, which may lead to remote code execution.</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1612785600">- Resync with python36 Factory package.
- Make this %primary_interpreter</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1613736000">Update to 3.6.13, final release of 3.6 branch:
  * Security
  - bpo#42967 (bsc#1182379, CVE-2021-23336): Fix web cache
    poisoning vulnerability by defaulting the query args
    separator to &amp;, and allowing the user to choose a custom
    separator.
  - bpo#42938 (bsc#1181126, CVE-2021-3177): Avoid static
    buffers when computing the repr of ctypes.c_double and
    ctypes.c_longdouble values.
  - bpo#42103: Prevented potential DoS attack via CPU and RAM
    exhaustion when processing malformed Apple Property List
    files in binary format.
  - bpo#42051: The plistlib module no longer accepts entity
    declarations in XML plist files to avoid XML
    vulnerabilities. This should not affect users as entity
    declarations are not used in regular plist files.
  - bpo#40791: Add volatile to the accumulator variable in
    hmac.compare_digest, making constant-time-defeating
    optimizations less likely.
  * Core and Builtins
  - bpo#35560: Fix an assertion error in format() in debug
    build for floating point formatting with ?n? format, zero
    padding and small width. Release build is not impacted.
    Patch by Karthikeyan Singaravelan.
  * Library
  - bpo#42103: InvalidFileException and RecursionError are now
    the only errors caused by loading malformed binary Plist
    file (previously ValueError and TypeError could be raised
    in some specific cases).
  * Tests
  - bpo#42794: Update test_nntplib to use offical group name of
    news.aioe.org for testing. Patch by Dong-hee Na.
  - bpo#41944: Tests for CJK codecs no longer call eval() on
    content received via HTTP.
- Patches removed, because they were included in the upstream
  tarball:
  - CVE-2020-27619-no-eval-http-content.patch
  - CVE-2021-3177-buf_ovrfl_PyCArg_repr.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1619524800">- Add CVE-2021-3426-inf-disclosure-pydoc-getfile.patch to remove
  getfile feature from pydoc, which is a security nightmare
  (among other things, CVE-2021-3426, allows disclosure of any
  file on the system; bsc#1183374, bpo#42988).</changelog>
  <changelog author="Ben Greiner &lt;code@bnavigator.de&gt;" date="1619956800">- Make sure to close the import_failed.map file after the exception
  has been raised in order to avoid ResourceWarnings when the
  failing import is part of a try...except block.</changelog>
  <changelog author="Johannes Engel &lt;jcnengel@gmail.com&gt;" date="1638100800">- Remove CVE-2021-3426-inf-disclosure-pydoc-getfile.patch
- Remove faulthandler_stack_overflow_on_GCC10.patch
- Update to 3.6.15
  * Security
    + bpo-44022: http.client now avoids infinitely reading
    potential HTTP headers after a 100 Continue status response
    from the server.
    + bpo-43882 Remove ASCII newlines and tabs from URLs
    + bpo-43285 ftplib no longer trusts the IP address value
    returned from the server in response to the PASV command by
    default. This prevents a malicious FTP server from using the
    response to probe IPv4 address and port combinations on the
    client network.
    + bpo-43075 Fix Regular Expression Denial of Service (ReDoS)
    vulnerability in urllib.request.AbstractBasicAuthHandler.
    + bpo-44394: Update the vendored copy of libexpat to 2.4.1
    (from 2.2.8) to get the fix for the CVE-2013-0340 ?Billion
    Laughs? vulnerability.
    + bpo-43124 Made the internal putcmd function in smtplib
    sanitize input for presence of \r and \n characters to avoid
    (unlikely) command injection.
    + bpo-45001: Made email date parsing more robust against
    malformed input, namely a whitespace-only Date: header.</changelog>
</package>
<package pkgid="a5b72cf6ab9efeb0901c4148aa94c7ac9b063d580bd6fcc3584942fd8ccd1e169d19f98aa64f2131801510150117c9c517b47d82ae87404cc5753430d7ee778a" name="talloc-man" arch="i586">
  <version epoch="0" ver="2.4.4" rel="156.3"/>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1583496000">- Upgrade to 2.3.1
  + Upgrade waf to 2.0.18 to fix a cross-compilation issue;
    (bso#13846).
  + lib/talloc: clang: Fix 'Value stored during its initialization
    is never read'.
  + Spelling fixes s/recieved/received/
  + talloc: ASAN fix for test_magic_protection.
  +  talloc: ASAN fix for test_rusty
  +  talloc: ASAN fix for test_pool_nest
  +  talloc: ASAN fix for test_talloc_free_in_destructor
  +  talloc: ASAN fix for test_realloc_on_destructor_parent</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602504000">- Fix build with RPM 4.16:
  bad %if condition:  01550 != 1110 || "x86_64" == x86_64
  no bare word support, x86_64 needs to be quoted</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1617192000">- Update to 2.3.2</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 2.3.3
  + python: Ensure reference counts are properly incremented
  + Change pytalloc source to LGPL;(bso#9931);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1663848000">- Update to 2.3.4
  + configure/Makefile: export PYTHONHASHSEED=1 in all
    'configure/Makefile' scripts
  + lib:replace: Reformat shell script
  + nsswitch: reduce dependecies to private libraries and link
    static/builtin if possible</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1679054400">- Update to 2.4.0
  * Add talloc_asprintf_addbuf()
  * Support python 3.12</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1695729600">-  Update to 2.4.1
  * Remove remaining, but broken python2 support
  * Spelling fixes
  * Remove unneeded va_copy()</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1715860800">- Update to 2.4.2
  * build with Python 3.12 (bso#15513)
  * documentation fixes
  * Update patch talloc-python3.5-fix-soabi_name.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1741608000">- Update to 2.4.3
  * Testsuite and documenation fixes
  * Add LGPLv3 LICENSE file</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1774612800">- Update to 2.4.4
  * lib: Add talloc_realloc_zero()
  * lib: docs: talloc: fix a wrong cd command
  * lib:talloc: Remove obsolete web page</changelog>
</package>
<package pkgid="854f5d6e4c1648db8f8ddffd3cad6fa7e51347a840b9a28e60a2f0d88e6af373c95f18ff41ef8e2373dd1c44887929bc89cda4a6af7c761dd98793b35f31a5c3" name="talloc-man" arch="src">
  <version epoch="0" ver="2.4.4" rel="156.3"/>
  <changelog author="jmcdonough@suse.com" date="1507550400">- Reference library name directly instead of using variables to
  pass obs source validator.</changelog>
  <changelog author="jmcdonough@suse.com" date="1521201600">- Update to version 2.1.11
  + disable-python - fix talloc wscript if bundling disabled
  + Do not disclose the random talloc magic in free()'ed memory</changelog>
  <changelog author="dimstar@opensuse.org" date="1522152000">- Eliminate usage of %__cp and %__mkdir_p.</changelog>
  <changelog author="jmcdonough@suse.com" date="1522929600">- Update to version 2.1.13
  + Use atexit() again instead of a library destructor; (bso#13366);
    (bso#7587).
  + Prevent assert in sssd (bso#7587).</changelog>
  <changelog author="dmulder@suse.com" date="1533729600">- Update to version 2.1.14
  + Fix some typos in the comments
  + Remove extra 0x prefix for the "%p" format specifiers,
    avoiding 0x0x0 strings in the output.
  + make sure we link extra-python versions of libraries</changelog>
  <changelog author="dmulder@suse.com" date="1549454400">- Update to version 2.1.15
  + Deprecate talloc_set_memlimit() and talloc_autofree_context()
  + Fix undefined behavior in talloc_memdup
  + The build uses python3 by default:
  + --extra-python would take python2 now
  + To build with python2 only use:
    PYTHON=python2 ./configure
    PYTHON=python2 make
    PYTHON=python2 make install</changelog>
  <changelog author="dmulder@suse.com" date="1551787200">- Update to version 2.1.16
  + Fix standalone build of talloc.</changelog>
  <changelog author="James McDonough &lt;jmcdonough@suse.com&gt;" date="1570104000">- Update to version 2.2.0
  + Remove pytalloc_CObject_FromTallocPtr()
  + Remove --extra-python (a build time mode to produce Python2 and Python3
    bindings at the same time)
  + New minor version to allow Samba 4.10 to release a talloc if
    required from that branch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1571659200">- Add two patches making build compatible with Python 3.8.0:
  - waf_upgrade.patch
  - waf_use_native_waf_timer.patch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1574769600">- Upgrade to 2.3.0.
- Patches waf_upgrade.patch and waf_use_native_waf_timer.patch
  are no needed anymore. They are subsumed by the upstream
  tarball.</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1583496000">- Upgrade to 2.3.1
  + Upgrade waf to 2.0.18 to fix a cross-compilation issue;
    (bso#13846).
  + lib/talloc: clang: Fix 'Value stored during its initialization
    is never read'.
  + Spelling fixes s/recieved/received/
  + talloc: ASAN fix for test_magic_protection.
  +  talloc: ASAN fix for test_rusty
  +  talloc: ASAN fix for test_pool_nest
  +  talloc: ASAN fix for test_talloc_free_in_destructor
  +  talloc: ASAN fix for test_realloc_on_destructor_parent</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602504000">- Fix build with RPM 4.16:
  bad %if condition:  01550 != 1110 || "x86_64" == x86_64
  no bare word support, x86_64 needs to be quoted</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1617192000">- Update to 2.3.2</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 2.3.3
  + python: Ensure reference counts are properly incremented
  + Change pytalloc source to LGPL;(bso#9931);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1663848000">- Update to 2.3.4
  + configure/Makefile: export PYTHONHASHSEED=1 in all
    'configure/Makefile' scripts
  + lib:replace: Reformat shell script
  + nsswitch: reduce dependecies to private libraries and link
    static/builtin if possible</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1679054400">- Update to 2.4.0
  * Add talloc_asprintf_addbuf()
  * Support python 3.12</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1695729600">-  Update to 2.4.1
  * Remove remaining, but broken python2 support
  * Spelling fixes
  * Remove unneeded va_copy()</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1715860800">- Update to 2.4.2
  * build with Python 3.12 (bso#15513)
  * documentation fixes
  * Update patch talloc-python3.5-fix-soabi_name.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1741608000">- Update to 2.4.3
  * Testsuite and documenation fixes
  * Add LGPLv3 LICENSE file</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1774612800">- Update to 2.4.4
  * lib: Add talloc_realloc_zero()
  * lib: docs: talloc: fix a wrong cd command
  * lib:talloc: Remove obsolete web page</changelog>
</package>
<package pkgid="3600dad8ff17448e0f157d8bd4ad3368fba6523d76563aee8b93cd2f3d33d5c4bdb9b7d26d605daba25c23fa11cc0eb05efb5d6ba60ea8db9098c69469f22722" name="talloc-man" arch="x86_64">
  <version epoch="0" ver="2.4.4" rel="156.3"/>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1583496000">- Upgrade to 2.3.1
  + Upgrade waf to 2.0.18 to fix a cross-compilation issue;
    (bso#13846).
  + lib/talloc: clang: Fix 'Value stored during its initialization
    is never read'.
  + Spelling fixes s/recieved/received/
  + talloc: ASAN fix for test_magic_protection.
  +  talloc: ASAN fix for test_rusty
  +  talloc: ASAN fix for test_pool_nest
  +  talloc: ASAN fix for test_talloc_free_in_destructor
  +  talloc: ASAN fix for test_realloc_on_destructor_parent</changelog>
  <changelog author="Dominique Leuenberger &lt;dimstar@opensuse.org&gt;" date="1602504000">- Fix build with RPM 4.16:
  bad %if condition:  01550 != 1110 || "x86_64" == x86_64
  no bare word support, x86_64 needs to be quoted</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1617192000">- Update to 2.3.2</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to 2.3.3
  + python: Ensure reference counts are properly incremented
  + Change pytalloc source to LGPL;(bso#9931);</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1663848000">- Update to 2.3.4
  + configure/Makefile: export PYTHONHASHSEED=1 in all
    'configure/Makefile' scripts
  + lib:replace: Reformat shell script
  + nsswitch: reduce dependecies to private libraries and link
    static/builtin if possible</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1679054400">- Update to 2.4.0
  * Add talloc_asprintf_addbuf()
  * Support python 3.12</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1695729600">-  Update to 2.4.1
  * Remove remaining, but broken python2 support
  * Spelling fixes
  * Remove unneeded va_copy()</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1715860800">- Update to 2.4.2
  * build with Python 3.12 (bso#15513)
  * documentation fixes
  * Update patch talloc-python3.5-fix-soabi_name.patch</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1741608000">- Update to 2.4.3
  * Testsuite and documenation fixes
  * Add LGPLv3 LICENSE file</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1774612800">- Update to 2.4.4
  * lib: Add talloc_realloc_zero()
  * lib: docs: talloc: fix a wrong cd command
  * lib:talloc: Remove obsolete web page</changelog>
</package>
<package pkgid="f38a117093126a1e9f011a75c82bbb1d5d747679b2bc1aa7c13cf82e076b92e928c925c514bba10a58f449a36093cfeadcae00bad7b10843898121be5816c4e8" name="tevent-man" arch="i586">
  <version epoch="0" ver="0.17.1" rel="137.8"/>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1583582400">- Update to version 0.10.2
  + Upgrade waf to version 2.0.18 to fix a cross-compilation issue;
    (bso#13846).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to version 0.11.0
  + Other minor build fixes; (bso#14526);
  + Add custom tag to events
  + Add event trace api</changelog>
  <changelog author="David Mulder &lt;dmulder@suse.com&gt;" date="1643803200">- Fix build on 15.3 (for the heimdal addc build), by bundling cmocka.</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1663848000">- Update to version 0.13.0
  + tevent: add tevent_cached_getpid() helper
- Update to version 0.12.0
  + tevent: Add tevent queue tracing support
  + tevent: Use internally an empty trigger function for
    blocker requests</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1679054400">- Update to version 0.14.1
  * Build fix for GNU/Hurd
  * Build fix for Solaris, after removal of ports backend (bso#15298)
- Changes from version 0.14.0
  * Support python 3.12
  * Remove solaris port backend
  * Make tevent_find_ops_byname() available for callers
  * Allow the "standard" backend to be overloaded
  * Add interface for request/subrequest call depth tracking</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1695729600">-  Update to version 0.15.0
  * remove py2 ifdefs
  * python: Safely clear structure members
  * the tevent_thread_call_depth API is updated
    in order to allow better tracing.
    pass TEVENT_DEBUG_TRACE to tevent_debug() callbacks by default.
  * Spelling fixes
  * Make use of epoll_create1() for epoll backend
  * Optimize overhead in the epoll backend</changelog>
  <changelog author="Jun Wang &lt;jgwang@suse.com&gt;" date="1705924800">- Update to version 0.16.0
  * the epoll backend is no longer limited to 2 event handlers
    per low level fd.
  * finally add support for TEVENT_FD_ERROR</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1715860800">- Update to version 0.16.1
  * build with Python 3.12 (bso#15513)
  * documentation fixes</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1741694400">- Update to version 0.16.2
  * Documentation fixes
  * Add LGPLv3 LICENSE file</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1760616000">- Update to 0.17.1
  * Fix 1649525 Use of 32-bit time_t
  * Fix Coverity ID 1649524 Dereference before null check
  * Fix Coverity ID 1649526 Dereference before null check
- Update to 0.17.0
  * add tevent_context_set_wait_timeout()</changelog>
</package>
<package pkgid="a99723a8e1c0c74069051356438d99eacdc32331434344b4fdc679c837a366636c34009543a719cfe3dbbac58ca7361b32dfd1061d8fafa0d0570f52f9508096" name="tevent-man" arch="src">
  <version epoch="0" ver="0.17.1" rel="137.8"/>
  <changelog author="scabrero@suse.com" date="1498824000">- Update to version 0.9.32
  + Fix mutex locking in tevent_threaded_context_destructor().
  + Fix a memleak on FreeBSD.
  + Re-init threading in tevent_re_initialise().
  + Include the finish location in tevent_req_default_print().</changelog>
  <changelog author="scabrero@suse.com" date="1501070400">- Update to version 0.9.33
  + make tevent_req_print() more robust against crashes</changelog>
  <changelog author="scabrero@suse.com" date="1511870400">- Update to version 0.9.34; (bsc#1069666);
  + Remove unused select backend
  + Fix a race condition in tevent_threaded_schedule_immediate();
    (bso#13130);</changelog>
  <changelog author="jmcdonough@suse.com" date="1521201600">- Update to version 0.9.36; (bso#13291);
  + improve documentation of tevent_queue_add_optimize_empty()
  + add tevent_queue_entry_untrigger()
  + Minor cleanup. wakeup_fd can always be gotten from the event context.
  + Use smb_set_close_on_exec() in example code.
- Use tirpc on newer sytems</changelog>
  <changelog author="dmulder@suse.com" date="1533729600">- Update to version 0.9.37
  + simplify "poll" and "poll_mt" backends
  + make tevent_abort() reachable for backends
  + add tevent_common_invoke_*_handler() functions
  + add tevent_context_same_loop() function
  + add tevent_context_wrapper_create() infrastructure
  + add tevent_req_profile infrastructure</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1537876800">- Update license to LGPL-3.0</changelog>
  <changelog author="dmulder@suse.com" date="1549454400">- Update to version 0.9.38
  + Deprecate tevent wrapper api again
  + Build fixes
  + The build uses python3 by default:
  + --extra-python would take python2 now
  + To build with python2 only use:
    PYTHON=python2 ./configure
    PYTHON=python2 make
    PYTHON=python2 make install</changelog>
  <changelog author="dmulder@suse.com" date="1551787200">- Update to version 0.9.39
  + py_tevent: add_timer takes float argument
  + C99 build fixes.
  + Fix standalone build of tevent.</changelog>
  <changelog author="James McDonough &lt;jmcdonough@suse.com&gt;" date="1570104000">- Update to version 0.10.0
  + Remove Python 2.x support except to build just the bare C library
  + Remove --extra-python (a build time mode to produce Python2 and Python3
    bindings at the same time)
  + New minor version to allow Samba 4.10 to release a tevent if
    required from that branch</changelog>
  <changelog author="Matej Cepl &lt;mcepl@suse.com&gt;" date="1574769600">- Update to 0.10.1 ... make build with Python 3.8 working again
  (new waf).</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1583582400">- Update to version 0.10.2
  + Upgrade waf to version 2.0.18 to fix a cross-compilation issue;
    (bso#13846).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to version 0.11.0
  + Other minor build fixes; (bso#14526);
  + Add custom tag to events
  + Add event trace api</changelog>
  <changelog author="David Mulder &lt;dmulder@suse.com&gt;" date="1643803200">- Fix build on 15.3 (for the heimdal addc build), by bundling cmocka.</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1663848000">- Update to version 0.13.0
  + tevent: add tevent_cached_getpid() helper
- Update to version 0.12.0
  + tevent: Add tevent queue tracing support
  + tevent: Use internally an empty trigger function for
    blocker requests</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1679054400">- Update to version 0.14.1
  * Build fix for GNU/Hurd
  * Build fix for Solaris, after removal of ports backend (bso#15298)
- Changes from version 0.14.0
  * Support python 3.12
  * Remove solaris port backend
  * Make tevent_find_ops_byname() available for callers
  * Allow the "standard" backend to be overloaded
  * Add interface for request/subrequest call depth tracking</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1695729600">-  Update to version 0.15.0
  * remove py2 ifdefs
  * python: Safely clear structure members
  * the tevent_thread_call_depth API is updated
    in order to allow better tracing.
    pass TEVENT_DEBUG_TRACE to tevent_debug() callbacks by default.
  * Spelling fixes
  * Make use of epoll_create1() for epoll backend
  * Optimize overhead in the epoll backend</changelog>
  <changelog author="Jun Wang &lt;jgwang@suse.com&gt;" date="1705924800">- Update to version 0.16.0
  * the epoll backend is no longer limited to 2 event handlers
    per low level fd.
  * finally add support for TEVENT_FD_ERROR</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1715860800">- Update to version 0.16.1
  * build with Python 3.12 (bso#15513)
  * documentation fixes</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1741694400">- Update to version 0.16.2
  * Documentation fixes
  * Add LGPLv3 LICENSE file</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1760616000">- Update to 0.17.1
  * Fix 1649525 Use of 32-bit time_t
  * Fix Coverity ID 1649524 Dereference before null check
  * Fix Coverity ID 1649526 Dereference before null check
- Update to 0.17.0
  * add tevent_context_set_wait_timeout()</changelog>
</package>
<package pkgid="f54127c54e70c7e0298c7d421417503c0d89c280b442fba97b9b197fc572b53cadbc17cc7ecf4907eca9d21c998a5f4820e7fbb3ac77238b4c94b003c86a2d66" name="tevent-man" arch="x86_64">
  <version epoch="0" ver="0.17.1" rel="137.8"/>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1583582400">- Update to version 0.10.2
  + Upgrade waf to version 2.0.18 to fix a cross-compilation issue;
    (bso#13846).</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1631880000">- Update to version 0.11.0
  + Other minor build fixes; (bso#14526);
  + Add custom tag to events
  + Add event trace api</changelog>
  <changelog author="David Mulder &lt;dmulder@suse.com&gt;" date="1643803200">- Fix build on 15.3 (for the heimdal addc build), by bundling cmocka.</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1663848000">- Update to version 0.13.0
  + tevent: add tevent_cached_getpid() helper
- Update to version 0.12.0
  + tevent: Add tevent queue tracing support
  + tevent: Use internally an empty trigger function for
    blocker requests</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1679054400">- Update to version 0.14.1
  * Build fix for GNU/Hurd
  * Build fix for Solaris, after removal of ports backend (bso#15298)
- Changes from version 0.14.0
  * Support python 3.12
  * Remove solaris port backend
  * Make tevent_find_ops_byname() available for callers
  * Allow the "standard" backend to be overloaded
  * Add interface for request/subrequest call depth tracking</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1695729600">-  Update to version 0.15.0
  * remove py2 ifdefs
  * python: Safely clear structure members
  * the tevent_thread_call_depth API is updated
    in order to allow better tracing.
    pass TEVENT_DEBUG_TRACE to tevent_debug() callbacks by default.
  * Spelling fixes
  * Make use of epoll_create1() for epoll backend
  * Optimize overhead in the epoll backend</changelog>
  <changelog author="Jun Wang &lt;jgwang@suse.com&gt;" date="1705924800">- Update to version 0.16.0
  * the epoll backend is no longer limited to 2 event handlers
    per low level fd.
  * finally add support for TEVENT_FD_ERROR</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1715860800">- Update to version 0.16.1
  * build with Python 3.12 (bso#15513)
  * documentation fixes</changelog>
  <changelog author="Samuel Cabrero &lt;scabrero@suse.de&gt;" date="1741694400">- Update to version 0.16.2
  * Documentation fixes
  * Add LGPLv3 LICENSE file</changelog>
  <changelog author="Noel Power &lt;nopower@suse.com&gt;" date="1760616000">- Update to 0.17.1
  * Fix 1649525 Use of 32-bit time_t
  * Fix Coverity ID 1649524 Dereference before null check
  * Fix Coverity ID 1649526 Dereference before null check
- Update to 0.17.0
  * add tevent_context_set_wait_timeout()</changelog>
</package>
</otherdata>