Bug 27594

Summary:	krb5 new security issue CVE-2020-28196
Product:	Mageia	Reporter:	David Walser <luigiwalser>
Component:	Security	Assignee:	QA Team <qa-bugs>
Status:	RESOLVED FIXED	QA Contact:	Sec team <security>
Severity:	major
Priority:	Normal	CC:	davidwhodgins, guillomovitch, ouaurelien, sysadmin-bugs
Version:	7	Keywords:	advisory, validated_update
Target Milestone:	---
Hardware:	All
OS:	Linux
Whiteboard:	MGA7-64-OK MGA7-32-OK
Source RPM:	krb5-1.17-2.mga7.src.rpm	CVE:	CVE-2020-28196
Status comment:

Description David Walser 2020-11-11 00:28:08 CET

Debian-LTS has issued an advisory on November 7:
https://www.debian.org/lts/security/2020/dla-2437

The issue is fixed upstream in 1.17.2 and 1.18.3.

Mageia 7 is also affected.

David Walser 2020-11-11 00:28:16 CET

Whiteboard: (none) => MGA7TOO

Comment 1 David Walser 2020-11-11 01:03:12 CET

Fedora has issued an advisory for this on November 9:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/

Comment 2 David Walser 2020-11-17 20:11:47 CET

Ubuntu has issued an advisory for this today (November 17):
https://ubuntu.com/security/notices/USN-4635-1

Status comment: (none) => Fixed upstream in 1.18.3
Severity: normal => major

Comment 3 David Walser 2020-11-19 20:20:03 CET

Fixed in krb5-1.18.3-1.mga8 in Cauldron by Guillaume.

Source RPM: krb5-1.18.2-1.mga8.src.rpm => krb5-1.17-2.mga7.src.rpm
Status comment: Fixed upstream in 1.18.3 => Fixed upstream in 1.17.2
Version: Cauldron => 7
Whiteboard: MGA7TOO => (none)

Comment 4 David Walser 2020-11-23 16:51:13 CET

Debian has issued an advisory for this on November 21:
https://www.debian.org/security/2020/dsa-4795

Comment 5 David Walser 2020-11-23 22:13:24 CET

Fedora has issued an advisory for 1.17 on November 21:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/

Comment 6 Guillaume Rousse 2020-12-29 16:41:35 CET

I just submitted krb5-1.17-2.1 in updates_testing for mageia 7.

Comment 7 David Walser 2020-12-29 17:29:52 CET

Advisory:
========================

Updated krb5 packages fix security vulnerability:

MIT Kerberos 5 (aka krb5) before 1.17.2 allows unbounded recursion via an
ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support
for BER indefinite lengths lacks a recursion limit (CVE-2020-28196).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28196
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-28196
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/
========================

Updated packages in core/updates_testing:
========================
krb5-1.17-2.1.mga7
libkrb53-devel-1.17-2.1.mga7
libkrb53-1.17-2.1.mga7
krb5-server-1.17-2.1.mga7
krb5-server-ldap-1.17-2.1.mga7
krb5-workstation-1.17-2.1.mga7
krb5-pkinit-1.17-2.1.mga7

from krb5-1.17-2.1.mga7.src.rpm

CC: (none) => guillomovitch
Status comment: Fixed upstream in 1.17.2 => (none)
Assignee: guillomovitch => qa-bugs

Comment 8 Dave Hodgins 2021-01-13 23:28:44 CET

Followed https://wiki.mageia.org/en/QA_procedure:Krb5 to get kerberos working
on both i586 and x86_64 Mageia 7 vb guests, installed the updates. Rebooted to
both to ensure all updates actually in use.

Confirmed kinit, klist and krlogin $(hostname) still work. All ok.

Validating the update.

Whiteboard: (none) => MGA7-64-OK MGA7-32-OK
Keywords: (none) => validated_update
CC: (none) => davidwhodgins, sysadmin-bugs

Comment 9 Aurelien Oudelet 2021-01-14 14:57:10 CET

Advisory pushed to SVN.

Keywords: (none) => advisory
CC: (none) => ouaurelien
CVE: (none) => CVE-2020-28196

Comment 10 Mageia Robot 2021-01-14 16:14:48 CET

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0022.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED