Security update for krb5 SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2018:0846-1 Final 1 1 2018-03-29T12:02:46Z current 2018-03-29T12:02:46Z 2018-03-29T12:02:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for krb5 This update for krb5 provides the following fixes: Security issues fixed: - CVE-2018-5730: DN container check bypass by supplying special crafted data (bsc#1083927). - CVE-2018-5729: Null pointer dereference in kadmind or DN container check bypass by supplying special crafted data (bsc#1083926). Non-security issues fixed: - Make it possible for legacy applications (e.g. SAP Netweaver) to remain compatible with newer Kerberos. System administrators who are experiencing this kind of compatibility issues may set the environment variable GSSAPI_ASSUME_MECH_MATCH to a non-empty value, and make sure the environment variable is visible and effective to the application startup script. (bsc#1057662) - Fix a GSS failure in legacy applications by not indicating deprecated GSS mechanisms in gss_indicate_mech() list. (bsc#1081725) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-OpenStack-Cloud-Magnum-Orchestration-7-2018-567,SUSE-SLE-DESKTOP-12-SP2-2018-567,SUSE-SLE-DESKTOP-12-SP3-2018-567,SUSE-SLE-RPI-12-SP2-2018-567,SUSE-SLE-SDK-12-SP2-2018-567,SUSE-SLE-SDK-12-SP3-2018-567,SUSE-SLE-SERVER-12-SP2-2018-567,SUSE-SLE-SERVER-12-SP3-2018-567 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2018/suse-su-20180846-1/ Link for SUSE-SU-2018:0846-1 https://lists.suse.com/pipermail/sle-security-updates/2018-March/003856.html E-Mail link for SUSE-SU-2018:0846-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1057662 SUSE Bug 1057662 https://bugzilla.suse.com/1081725 SUSE Bug 1081725 https://bugzilla.suse.com/1083926 SUSE Bug 1083926 https://bugzilla.suse.com/1083927 SUSE Bug 1083927 https://www.suse.com/security/cve/CVE-2018-5729/ SUSE CVE CVE-2018-5729 page https://www.suse.com/security/cve/CVE-2018-5730/ SUSE CVE CVE-2018-5730 page SUSE Linux Enterprise Desktop 12 SP2 SUSE Linux Enterprise Desktop 12 SP3 SUSE Linux Enterprise Server 12 SP2 SUSE Linux Enterprise Server 12 SP3 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP2 SUSE Linux Enterprise Server for SAP Applications 12 SP3 SUSE Linux Enterprise Software Development Kit 12 SP2 SUSE Linux Enterprise Software Development Kit 12 SP3 krb5-1.12.5-40.23.2 krb5-32bit-1.12.5-40.23.2 krb5-client-1.12.5-40.23.2 krb5-doc-1.12.5-40.23.2 krb5-plugin-kdb-ldap-1.12.5-40.23.2 krb5-plugin-preauth-otp-1.12.5-40.23.2 krb5-plugin-preauth-pkinit-1.12.5-40.23.2 krb5-server-1.12.5-40.23.2 krb5-devel-1.12.5-40.23.2 krb5-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Desktop 12 SP2 krb5-32bit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Desktop 12 SP2 krb5-client-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Desktop 12 SP2 krb5-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 krb5-32bit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 krb5-client-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Desktop 12 SP3 krb5-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP2 krb5-32bit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP2 krb5-client-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP2 krb5-doc-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP2 krb5-plugin-kdb-ldap-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP2 krb5-plugin-preauth-otp-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP2 krb5-plugin-preauth-pkinit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP2 krb5-server-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP2 krb5-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP3 krb5-32bit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP3 krb5-client-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP3 krb5-doc-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP3 krb5-plugin-kdb-ldap-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP3 krb5-plugin-preauth-otp-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP3 krb5-plugin-preauth-pkinit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP3 krb5-server-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server 12 SP3 krb5-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 krb5-client-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 krb5-doc-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 krb5-plugin-kdb-ldap-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 krb5-plugin-preauth-otp-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 krb5-plugin-preauth-pkinit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 krb5-server-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for Raspberry Pi 12 SP2 krb5-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 krb5-32bit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 krb5-client-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 krb5-doc-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 krb5-plugin-kdb-ldap-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 krb5-plugin-preauth-otp-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 krb5-plugin-preauth-pkinit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 krb5-server-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP2 krb5-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 krb5-32bit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 krb5-client-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 krb5-doc-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 krb5-plugin-kdb-ldap-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 krb5-plugin-preauth-otp-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 krb5-plugin-preauth-pkinit-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 krb5-server-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP3 krb5-devel-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP2 krb5-devel-1.12.5-40.23.2 as a component of SUSE Linux Enterprise Software Development Kit 12 SP3 MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. CVE-2018-5729 SUSE Linux Enterprise Desktop 12 SP2:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP2:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP2:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP3:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP3:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP3:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Software Development Kit 12 SP2:krb5-devel-1.12.5-40.23.2 SUSE Linux Enterprise Software Development Kit 12 SP3:krb5-devel-1.12.5-40.23.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180846-1/ https://www.suse.com/security/cve/CVE-2018-5729.html CVE-2018-5729 https://bugzilla.suse.com/1076211 SUSE Bug 1076211 https://bugzilla.suse.com/1083926 SUSE Bug 1083926 https://bugzilla.suse.com/1122468 SUSE Bug 1122468 MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. CVE-2018-5730 SUSE Linux Enterprise Desktop 12 SP2:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP2:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP2:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP3:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP3:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Desktop 12 SP3:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP2:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server 12 SP3:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server for Raspberry Pi 12 SP2:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP2:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-32bit-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-client-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-doc-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-plugin-kdb-ldap-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-plugin-preauth-otp-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-plugin-preauth-pkinit-1.12.5-40.23.2 SUSE Linux Enterprise Server for SAP Applications 12 SP3:krb5-server-1.12.5-40.23.2 SUSE Linux Enterprise Software Development Kit 12 SP2:krb5-devel-1.12.5-40.23.2 SUSE Linux Enterprise Software Development Kit 12 SP3:krb5-devel-1.12.5-40.23.2 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2018/suse-su-20180846-1/ https://www.suse.com/security/cve/CVE-2018-5730.html CVE-2018-5730 https://bugzilla.suse.com/1076211 SUSE Bug 1076211 https://bugzilla.suse.com/1083927 SUSE Bug 1083927 https://bugzilla.suse.com/1122468 SUSE Bug 1122468