<?xml version="1.0" encoding="UTF-8"?>
<otherdata xmlns="http://linux.duke.edu/metadata/other" packages="21"><package pkgid="00506cd1d6a311bc9129152d7ae2eee9ca1b22fdac0f1a0c3f62a81f30593029" name="krb5-mini" arch="src">
    <version epoch="0" ver="1.15" rel="243.1"/>

<changelog author="ddiss@suse.com" date="1411646400">- Work around replay cache creation race; (bnc#898439).
  krb5-1.13-work-around-replay-cache-creation-race.patch</changelog>
<changelog author="mlin@suse.com" date="1420545600">- Update to krb5 1.13
  * Add support for accessing KDCs via an HTTPS proxy server using the
    MS-KKDCP protocol.
  * Add support for hierarchical incremental propagation, where slaves
    can act as intermediates between an upstream master and other downstream
    slaves.
  * Add support for configuring GSS mechanisms using /etc/gss/mech.d/*.conf
    files in addition to /etc/gss/mech.
  * Add support to the LDAP KDB module for binding to the LDAP server using
    SASL.
  * The KDC listens for TCP connections by default.
  * Fix a minor key disclosure vulnerability where using the "keepold" option
    to the kadmin randkey operation could return the old keys. [CVE-2014-5351]
  * Add client support for the Kerberos Cache Manager protocol. If the host
    is running a Heimdal kcm daemon, caches served by the daemon can be
    accessed with the KCM: cache type.
  * When built on OS X 10.7 and higher, use "KCM:" as the default cache type,
    unless overridden by command-line options or krb5-config values.
  * Add support for doing unlocked database dumps for the DB2 KDC back end,
    which would allow the KDC and kadmind to continue accessing the database
    during lengthy database dumps.
- Removed patches, useless or upstreamed
  * krb5-1.9-kprop-mktemp.patch
  * krb5-1.10-ksu-access.patch
  * krb5-1.12-doxygen.patch
  * bnc#897874-CVE-2014-5351.diff
  * krb5-1.13-work-around-replay-cache-creation-race.patch
  * krb5-1.10-kpasswd_tcp.patch
- Refreshed patches
  * krb5-1.12-pam.patch
  * krb5-1.12-selinux-label.patch
  * krb5-1.7-doublelog.patch</changelog>
<changelog author="michael@stroeder.com" date="1424260800">- update to krb5 1.13.1
  Major changes in 1.13.1 (2015-02-11)
  This is a bug fix release.
  * Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354] [CVE-2014-5353]
  * Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421
  CVE-2014-9422 CVE-2014-9423]</changelog>
<changelog author="hguo@suse.com" date="1429790400">- Use externally built libverto</changelog>
<changelog author="michael@stroeder.com" date="1431432000">- update to krb5 1.13.2
- DES transition
  ==============
  The Data Encryption Standard (DES) is widely recognized as weak.  The
  krb5-1.7 release contains measures to encourage sites to migrate away
- From using single-DES cryptosystems.  Among these is a configuration
  variable that enables "weak" enctypes, which defaults to "false"
  beginning with krb5-1.8.
  Major changes in 1.13.2 (2015-05-08)
  This is a bug fix release.
  * Fix a minor vulnerability in krb5_read_message, which is primarily
  used in the BSD-derived kcmd suite of applications.  [CVE-2014-5355]
  * Fix a bypass of requires_preauth in KDCs that have PKINIT enabled.
  [CVE-2015-2694]
  * Fix some issues with the LDAP KDC database back end.
  * Fix an iteration-related memory leak in the DB2 KDC database back
  end.
  * Fix issues with some less-used kadm5.acl functionality.
  * Improve documentation.</changelog>
<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5 pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clena-ups in spec file.
- Change package description to explain what "mini" means.</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>
<package pkgid="7e959d65a173f39af65e1a86776541cce92a467cc32888b3c0f993276ebd4f16" name="krb5-mini" arch="x86_64">
    <version epoch="0" ver="1.15" rel="243.1"/>

<changelog author="ddiss@suse.com" date="1411646400">- Work around replay cache creation race; (bnc#898439).
  krb5-1.13-work-around-replay-cache-creation-race.patch</changelog>
<changelog author="mlin@suse.com" date="1420545600">- Update to krb5 1.13
  * Add support for accessing KDCs via an HTTPS proxy server using the
    MS-KKDCP protocol.
  * Add support for hierarchical incremental propagation, where slaves
    can act as intermediates between an upstream master and other downstream
    slaves.
  * Add support for configuring GSS mechanisms using /etc/gss/mech.d/*.conf
    files in addition to /etc/gss/mech.
  * Add support to the LDAP KDB module for binding to the LDAP server using
    SASL.
  * The KDC listens for TCP connections by default.
  * Fix a minor key disclosure vulnerability where using the "keepold" option
    to the kadmin randkey operation could return the old keys. [CVE-2014-5351]
  * Add client support for the Kerberos Cache Manager protocol. If the host
    is running a Heimdal kcm daemon, caches served by the daemon can be
    accessed with the KCM: cache type.
  * When built on OS X 10.7 and higher, use "KCM:" as the default cache type,
    unless overridden by command-line options or krb5-config values.
  * Add support for doing unlocked database dumps for the DB2 KDC back end,
    which would allow the KDC and kadmind to continue accessing the database
    during lengthy database dumps.
- Removed patches, useless or upstreamed
  * krb5-1.9-kprop-mktemp.patch
  * krb5-1.10-ksu-access.patch
  * krb5-1.12-doxygen.patch
  * bnc#897874-CVE-2014-5351.diff
  * krb5-1.13-work-around-replay-cache-creation-race.patch
  * krb5-1.10-kpasswd_tcp.patch
- Refreshed patches
  * krb5-1.12-pam.patch
  * krb5-1.12-selinux-label.patch
  * krb5-1.7-doublelog.patch</changelog>
<changelog author="michael@stroeder.com" date="1424260800">- update to krb5 1.13.1
  Major changes in 1.13.1 (2015-02-11)
  This is a bug fix release.
  * Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354] [CVE-2014-5353]
  * Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421
  CVE-2014-9422 CVE-2014-9423]</changelog>
<changelog author="hguo@suse.com" date="1429790400">- Use externally built libverto</changelog>
<changelog author="michael@stroeder.com" date="1431432000">- update to krb5 1.13.2
- DES transition
  ==============
  The Data Encryption Standard (DES) is widely recognized as weak.  The
  krb5-1.7 release contains measures to encourage sites to migrate away
- From using single-DES cryptosystems.  Among these is a configuration
  variable that enables "weak" enctypes, which defaults to "false"
  beginning with krb5-1.8.
  Major changes in 1.13.2 (2015-05-08)
  This is a bug fix release.
  * Fix a minor vulnerability in krb5_read_message, which is primarily
  used in the BSD-derived kcmd suite of applications.  [CVE-2014-5355]
  * Fix a bypass of requires_preauth in KDCs that have PKINIT enabled.
  [CVE-2015-2694]
  * Fix some issues with the LDAP KDC database back end.
  * Fix an iteration-related memory leak in the DB2 KDC database back
  end.
  * Fix issues with some less-used kadm5.acl functionality.
  * Improve documentation.</changelog>
<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5 pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clena-ups in spec file.
- Change package description to explain what "mini" means.</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>
<package pkgid="a9ff43d87e4338e5036c3eb005fb14886622e65206cc78778e34ed9934ca475a" name="krb5-mini-debuginfo" arch="x86_64">
    <version epoch="0" ver="1.15" rel="243.1"/>

<changelog author="ddiss@suse.com" date="1411646400">- Work around replay cache creation race; (bnc#898439).
  krb5-1.13-work-around-replay-cache-creation-race.patch</changelog>
<changelog author="mlin@suse.com" date="1420545600">- Update to krb5 1.13
  * Add support for accessing KDCs via an HTTPS proxy server using the
    MS-KKDCP protocol.
  * Add support for hierarchical incremental propagation, where slaves
    can act as intermediates between an upstream master and other downstream
    slaves.
  * Add support for configuring GSS mechanisms using /etc/gss/mech.d/*.conf
    files in addition to /etc/gss/mech.
  * Add support to the LDAP KDB module for binding to the LDAP server using
    SASL.
  * The KDC listens for TCP connections by default.
  * Fix a minor key disclosure vulnerability where using the "keepold" option
    to the kadmin randkey operation could return the old keys. [CVE-2014-5351]
  * Add client support for the Kerberos Cache Manager protocol. If the host
    is running a Heimdal kcm daemon, caches served by the daemon can be
    accessed with the KCM: cache type.
  * When built on OS X 10.7 and higher, use "KCM:" as the default cache type,
    unless overridden by command-line options or krb5-config values.
  * Add support for doing unlocked database dumps for the DB2 KDC back end,
    which would allow the KDC and kadmind to continue accessing the database
    during lengthy database dumps.
- Removed patches, useless or upstreamed
  * krb5-1.9-kprop-mktemp.patch
  * krb5-1.10-ksu-access.patch
  * krb5-1.12-doxygen.patch
  * bnc#897874-CVE-2014-5351.diff
  * krb5-1.13-work-around-replay-cache-creation-race.patch
  * krb5-1.10-kpasswd_tcp.patch
- Refreshed patches
  * krb5-1.12-pam.patch
  * krb5-1.12-selinux-label.patch
  * krb5-1.7-doublelog.patch</changelog>
<changelog author="michael@stroeder.com" date="1424260800">- update to krb5 1.13.1
  Major changes in 1.13.1 (2015-02-11)
  This is a bug fix release.
  * Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354] [CVE-2014-5353]
  * Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421
  CVE-2014-9422 CVE-2014-9423]</changelog>
<changelog author="hguo@suse.com" date="1429790400">- Use externally built libverto</changelog>
<changelog author="michael@stroeder.com" date="1431432000">- update to krb5 1.13.2
- DES transition
  ==============
  The Data Encryption Standard (DES) is widely recognized as weak.  The
  krb5-1.7 release contains measures to encourage sites to migrate away
- From using single-DES cryptosystems.  Among these is a configuration
  variable that enables "weak" enctypes, which defaults to "false"
  beginning with krb5-1.8.
  Major changes in 1.13.2 (2015-05-08)
  This is a bug fix release.
  * Fix a minor vulnerability in krb5_read_message, which is primarily
  used in the BSD-derived kcmd suite of applications.  [CVE-2014-5355]
  * Fix a bypass of requires_preauth in KDCs that have PKINIT enabled.
  [CVE-2015-2694]
  * Fix some issues with the LDAP KDC database back end.
  * Fix an iteration-related memory leak in the DB2 KDC database back
  end.
  * Fix issues with some less-used kadm5.acl functionality.
  * Improve documentation.</changelog>
<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5 pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clena-ups in spec file.
- Change package description to explain what "mini" means.</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>
<package pkgid="3514b1bc38e71d4e65492bb8163ceb23d59689fabb6b8afe0bbdccb13b5468eb" name="krb5-mini-debugsource" arch="x86_64">
    <version epoch="0" ver="1.15" rel="243.1"/>

<changelog author="ddiss@suse.com" date="1411646400">- Work around replay cache creation race; (bnc#898439).
  krb5-1.13-work-around-replay-cache-creation-race.patch</changelog>
<changelog author="mlin@suse.com" date="1420545600">- Update to krb5 1.13
  * Add support for accessing KDCs via an HTTPS proxy server using the
    MS-KKDCP protocol.
  * Add support for hierarchical incremental propagation, where slaves
    can act as intermediates between an upstream master and other downstream
    slaves.
  * Add support for configuring GSS mechanisms using /etc/gss/mech.d/*.conf
    files in addition to /etc/gss/mech.
  * Add support to the LDAP KDB module for binding to the LDAP server using
    SASL.
  * The KDC listens for TCP connections by default.
  * Fix a minor key disclosure vulnerability where using the "keepold" option
    to the kadmin randkey operation could return the old keys. [CVE-2014-5351]
  * Add client support for the Kerberos Cache Manager protocol. If the host
    is running a Heimdal kcm daemon, caches served by the daemon can be
    accessed with the KCM: cache type.
  * When built on OS X 10.7 and higher, use "KCM:" as the default cache type,
    unless overridden by command-line options or krb5-config values.
  * Add support for doing unlocked database dumps for the DB2 KDC back end,
    which would allow the KDC and kadmind to continue accessing the database
    during lengthy database dumps.
- Removed patches, useless or upstreamed
  * krb5-1.9-kprop-mktemp.patch
  * krb5-1.10-ksu-access.patch
  * krb5-1.12-doxygen.patch
  * bnc#897874-CVE-2014-5351.diff
  * krb5-1.13-work-around-replay-cache-creation-race.patch
  * krb5-1.10-kpasswd_tcp.patch
- Refreshed patches
  * krb5-1.12-pam.patch
  * krb5-1.12-selinux-label.patch
  * krb5-1.7-doublelog.patch</changelog>
<changelog author="michael@stroeder.com" date="1424260800">- update to krb5 1.13.1
  Major changes in 1.13.1 (2015-02-11)
  This is a bug fix release.
  * Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354] [CVE-2014-5353]
  * Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421
  CVE-2014-9422 CVE-2014-9423]</changelog>
<changelog author="hguo@suse.com" date="1429790400">- Use externally built libverto</changelog>
<changelog author="michael@stroeder.com" date="1431432000">- update to krb5 1.13.2
- DES transition
  ==============
  The Data Encryption Standard (DES) is widely recognized as weak.  The
  krb5-1.7 release contains measures to encourage sites to migrate away
- From using single-DES cryptosystems.  Among these is a configuration
  variable that enables "weak" enctypes, which defaults to "false"
  beginning with krb5-1.8.
  Major changes in 1.13.2 (2015-05-08)
  This is a bug fix release.
  * Fix a minor vulnerability in krb5_read_message, which is primarily
  used in the BSD-derived kcmd suite of applications.  [CVE-2014-5355]
  * Fix a bypass of requires_preauth in KDCs that have PKINIT enabled.
  [CVE-2015-2694]
  * Fix some issues with the LDAP KDC database back end.
  * Fix an iteration-related memory leak in the DB2 KDC database back
  end.
  * Fix issues with some less-used kadm5.acl functionality.
  * Improve documentation.</changelog>
<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5 pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clena-ups in spec file.
- Change package description to explain what "mini" means.</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>
<package pkgid="6721522a8beae5ee062611979eb02be7fd91e6a2a6c43197f47d0693ca5b6e59" name="krb5-mini-devel" arch="x86_64">
    <version epoch="0" ver="1.15" rel="243.1"/>

<changelog author="ddiss@suse.com" date="1411646400">- Work around replay cache creation race; (bnc#898439).
  krb5-1.13-work-around-replay-cache-creation-race.patch</changelog>
<changelog author="mlin@suse.com" date="1420545600">- Update to krb5 1.13
  * Add support for accessing KDCs via an HTTPS proxy server using the
    MS-KKDCP protocol.
  * Add support for hierarchical incremental propagation, where slaves
    can act as intermediates between an upstream master and other downstream
    slaves.
  * Add support for configuring GSS mechanisms using /etc/gss/mech.d/*.conf
    files in addition to /etc/gss/mech.
  * Add support to the LDAP KDB module for binding to the LDAP server using
    SASL.
  * The KDC listens for TCP connections by default.
  * Fix a minor key disclosure vulnerability where using the "keepold" option
    to the kadmin randkey operation could return the old keys. [CVE-2014-5351]
  * Add client support for the Kerberos Cache Manager protocol. If the host
    is running a Heimdal kcm daemon, caches served by the daemon can be
    accessed with the KCM: cache type.
  * When built on OS X 10.7 and higher, use "KCM:" as the default cache type,
    unless overridden by command-line options or krb5-config values.
  * Add support for doing unlocked database dumps for the DB2 KDC back end,
    which would allow the KDC and kadmind to continue accessing the database
    during lengthy database dumps.
- Removed patches, useless or upstreamed
  * krb5-1.9-kprop-mktemp.patch
  * krb5-1.10-ksu-access.patch
  * krb5-1.12-doxygen.patch
  * bnc#897874-CVE-2014-5351.diff
  * krb5-1.13-work-around-replay-cache-creation-race.patch
  * krb5-1.10-kpasswd_tcp.patch
- Refreshed patches
  * krb5-1.12-pam.patch
  * krb5-1.12-selinux-label.patch
  * krb5-1.7-doublelog.patch</changelog>
<changelog author="michael@stroeder.com" date="1424260800">- update to krb5 1.13.1
  Major changes in 1.13.1 (2015-02-11)
  This is a bug fix release.
  * Fix multiple vulnerabilities in the LDAP KDC back end.
  [CVE-2014-5354] [CVE-2014-5353]
  * Fix multiple kadmind vulnerabilities, some of which are based in the
  gssrpc library. [CVE-2014-5352 CVE-2014-5352 CVE-2014-9421
  CVE-2014-9422 CVE-2014-9423]</changelog>
<changelog author="hguo@suse.com" date="1429790400">- Use externally built libverto</changelog>
<changelog author="michael@stroeder.com" date="1431432000">- update to krb5 1.13.2
- DES transition
  ==============
  The Data Encryption Standard (DES) is widely recognized as weak.  The
  krb5-1.7 release contains measures to encourage sites to migrate away
- From using single-DES cryptosystems.  Among these is a configuration
  variable that enables "weak" enctypes, which defaults to "false"
  beginning with krb5-1.8.
  Major changes in 1.13.2 (2015-05-08)
  This is a bug fix release.
  * Fix a minor vulnerability in krb5_read_message, which is primarily
  used in the BSD-derived kcmd suite of applications.  [CVE-2014-5355]
  * Fix a bypass of requires_preauth in KDCs that have PKINIT enabled.
  [CVE-2015-2694]
  * Fix some issues with the LDAP KDC database back end.
  * Fix an iteration-related memory leak in the DB2 KDC database back
  end.
  * Fix issues with some less-used kadm5.acl functionality.
  * Improve documentation.</changelog>
<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5 pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clena-ups in spec file.
- Change package description to explain what "mini" means.</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="3ebbd235f448aebcba177f66cc154baeb2cd977bcaaf8ff198fe55c6e0c3a718" name="krb5" arch="src">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="8e3dff792f97acdea21a09816e7ddabae68cab2918da297be93a87d3666f1fee" name="krb5" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="3044a83604a5f901ddd3f59b808a309b1317b40eb871a39550184b3b5ba4aaaf" name="krb5-client" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="9a0f01989847c0d59f4543a062762dcb83ae49a8ac39e2624c8283c5670be822" name="krb5-client-debuginfo" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="739c23597711ffc501bc03ad0a9e6c73fcb8b093a08aec693dcb0303f48e5edd" name="krb5-debuginfo" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="0e9f1ac1355fda9e6103a771833fe43697550e73635f34f72e80891e8001a662" name="krb5-debugsource" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="d79646061755e85f753c130d1d08a941a21201212a6cabca4d5fa712f5dca288" name="krb5-devel" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="aa4105bcd2b100b1200dcd23ee6fc8ca978ce710f35df336de56bf8c502145ce" name="krb5-doc" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="8a3c153ce3f1aab61cebbf69f852b7d9f0d5c10188d6e56a5f689d559bed4009" name="krb5-plugin-kdb-ldap" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="22276bd4274184b0a35f4a914d156b36d70ca464a09af705a4e75662fa892fe5" name="krb5-plugin-kdb-ldap-debuginfo" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="f6527a935d2ec01c919adad63a5a08614150d6e94120b356159bd5d81d260ccc" name="krb5-plugin-preauth-otp" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="efb2ba297a1361a20831ea3ecbc2fa077ed8966d56dd1d3e6484389dcaabcda1" name="krb5-plugin-preauth-otp-debuginfo" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="9bc54836c9430c866d99bed8214456027a99469cd9d221a5fa70ce7f7a3694ce" name="krb5-plugin-preauth-pkinit" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="25a022f726d32cfb8407f0b3fe377145fcbd8b09f1332ec47e557a6d96b8d9e7" name="krb5-plugin-preauth-pkinit-debuginfo" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="a467fbda07dad470f66a5cc921b9fec5faf50b242026c5690bce8c78e41dcf99" name="krb5-server" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

<package pkgid="cb81dc414e542b6f055eeec23d60dd92247be4a5d0a12bf43fd9f53989d0c24e" name="krb5-server-debuginfo" arch="x86_64">
    <version epoch="0" ver="1.15" rel="245.2"/>

<changelog author="meissner@suse.com" date="1432296000">- pre_checkin.sh aligned changes between krb5/krb5-mini
- added krb5.keyring</changelog>
<changelog author="dimstar@opensuse.org" date="1432728000">- Unconditionally buildrequire libverto-devel: krb5-mini also
  depends on it.</changelog>
<changelog author="dimstar@opensuse.org" date="1432814400">- Drop libverto and libverto-libev Requires from the -server
  package: those package names don't exist and the shared libs
  are pulled in automatically.</changelog>
<changelog author="hguo@suse.com" date="1433160000">- Let server depend on libev (module of libverto). This was the
  preferred implementation before the seperation of libverto from krb.</changelog>
<changelog author="hguo@suse.com" date="1446033600">- Make kadmin.local man page available without having to install krb5-client. bsc#948011
- Apply patch 0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  to fix build_principal memory bug [CVE-2015-2697] bsc#952190
- Apply patch 0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  to fix IAKERB context aliasing bugs [CVE-2015-2696] bsc#952189
- Apply patch 0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  to fix SPNEGO context aliasing bugs [CVE-2015-2695] bsc#952188</changelog>
<changelog author="hguo@suse.com" date="1447156800">- Apply patch 0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  to fix a memory corruption regression introduced by resolution of
  CVE-2015-2698. bsc#954204</changelog>
<changelog author="michael@stroeder.com" date="1449489600">- Update to 1.13.3
- removed patches for security fixes now in upstream source:
  0100-Fix-build_principal-memory-bug-CVE-2015-2697.patch
  0101-Fix-IAKERB-context-aliasing-bugs-CVE-2015-2696.patch
  0102-Fix-SPNEGO-context-aliasing-bugs-CVE-2015-2695.patch
  0103-Fix-IAKERB-context-export-import-CVE-2015-2698.patch
  Major changes in 1.13.3 (2015-12-04)
  This is a bug fix release.  The krb5-1.13 release series is in
  maintenance, and for new deployments, installers should prefer the
  krb5-1.14 release series or later.
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  * Allow an iprop slave to receive full resyncs from KDCs running
  krb5-1.10 or earlier.</changelog>
<changelog author="michael@stroeder.com" date="1449576000">- Update to 1.14
- dropped krb5-kvno-230379.patch
- added krbdev.mit.edu-8301.patch fixing wrong function call
  Major changes in 1.14 (2015-11-20)
  Administrator experience:
  * Add a new kdb5_util tabdump command to provide reporting-friendly
  tabular dump formats (tab-separated or CSV) for the KDC database.
  Unlike the normal dump format, each output table has a fixed number
  of fields.  Some tables include human-readable forms of data that
  are opaque in ordinary dump files.  This format is also suitable for
  importing into relational databases for complex queries.
  * Add support to kadmin and kadmin.local for specifying a single
  command line following any global options, where the command
  arguments are split by the shell--for example, "kadmin getprinc
  principalname".  Commands issued this way do not prompt for
  confirmation or display warning messages, and exit with non-zero
  status if the operation fails.
  * Accept the same principal flag names in kadmin as we do for the
  default_principal_flags kdc.conf variable, and vice versa.  Also
  accept flag specifiers in the form that kadmin prints, as well as
  hexadecimal numbers.
  * Remove the triple-DES and RC4 encryption types from the default
  value of supported_enctypes, which determines the default key and
  salt types for new password-derived keys.  By default, keys will
  only created only for AES128 and AES256.  This mitigates some types
  of password guessing attacks.
  * Add support for directory names in the KRB5_CONFIG and
  KRB5_KDC_PROFILE environment variables.
  * Add support for authentication indicators, which are ticket
  annotations to indicate the strength of the initial authentication.
  Add support for the "require_auth" string attribute, which can be
  set on server principal entries to require an indicator when
  authenticating to the server.
  * Add support for key version numbers larger than 255 in keytab files,
  and for version numbers up to 65535 in KDC databases.
  * Transmit only one ETYPE-INFO and/or ETYPE-INFO2 entry from the KDC
  during pre-authentication, corresponding to the client's most
  preferred encryption type.
  * Add support for server name identification (SNI) when proxying KDC
  requests over HTTPS.
  * Add support for the err_fmt profile parameter, which can be used to
  generate custom-formatted error messages.
  Code quality:
  * Fix memory aliasing issues in SPNEGO and IAKERB mechanisms that
  could cause server crashes. [CVE-2015-2695] [CVE-2015-2696]
  [CVE-2015-2698]
  * Fix build_principal memory bug that could cause a KDC
  crash. [CVE-2015-2697]
  Developer experience:
  * Change gss_acquire_cred_with_password() to acquire credentials into
  a private memory credential cache.  Applications can use
  gss_store_cred() to make the resulting credentials visible to other
  processes.
  * Change gss_acquire_cred() and SPNEGO not to acquire credentials for
  IAKERB or for non-standard variants of the krb5 mechanism OID unless
  explicitly requested.  (SPNEGO will still accept the Microsoft
  variant of the krb5 mechanism OID during negotiation.)
  * Change gss_accept_sec_context() not to accept tokens for IAKERB or
  for non-standard variants of the krb5 mechanism OID unless an
  acceptor credential is acquired for those mechanisms.
  * Change gss_acquire_cred() to immediately resolve credentials if the
  time_rec parameter is not NULL, so that a correct expiration time
  can be returned.  Normally credential resolution is delayed until
  the target name is known.
  * Add krb5_prepend_error_message() and krb5_wrap_error_message() APIs,
  which can be used by plugin modules or applications to add prefixes
  to existing detailed error messages.
  * Add krb5_c_prfplus() and krb5_c_derive_prfplus() APIs, which
  implement the RFC 6113 PRF+ operation and key derivation using PRF+.
  * Add support for pre-authentication mechanisms which use multiple
  round trips, using the the KDC_ERR_MORE_PREAUTH_DATA_REQUIRED error
  code.  Add get_cookie() and set_cookie() callbacks to the kdcpreauth
  interface; these callbacks can be used to save marshalled state
  information in an encrypted cookie for the next request.
  * Add a client_key() callback to the kdcpreauth interface to retrieve
  the chosen client key, corresponding to the ETYPE-INFO2 entry sent
  by the KDC.
  * Add an add_auth_indicator() callback to the kdcpreauth interface,
  allowing pre-authentication modules to assert authentication
  indicators.
  * Add support for the GSS_KRB5_CRED_NO_CI_FLAGS_X cred option to
  suppress sending the confidentiality and integrity flags in GSS
  initiator tokens unless they are requested by the caller.  These
  flags control the negotiated SASL security layer for the Microsoft
  GSS-SPNEGO SASL mechanism.
  * Make the FILE credential cache implementation less prone to
  corruption issues in multi-threaded programs, especially on
  platforms with support for open file description locks.
  Performance:
  * On slave KDCs, poll the master KDC immediately after processing a
  full resync, and do not require two full resyncs after the master
  KDC's log file is reset.
  User experience:
  * Make gss_accept_sec_context() accept tickets near their expiration
  but within clock skew tolerances, rather than rejecting them
  immediately after the server's view of the ticket expiration time.</changelog>
<changelog author="idonmez@suse.com" date="1452513600">- Add two patches from Fedora, fixing two crashes:
  * krb5-fix_interposer.patch
  * krb5-mechglue_inqure_attrs.patch</changelog>
<changelog author="hguo@suse.com" date="1454414400">- Fix CVE-2015-8629: krb5: xdr_nullstring() doesn't check for terminating null character
  with patch 0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
  (bsc#963968)
- Fix CVE-2015-8631: krb5: Memory leak caused by supplying a null principal name in request
  with patch 0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
  (bsc#963975)
- Fix CVE-2015-8630: krb5: krb5 doesn't check for null policy when KADM5_POLICY is set in the mask
  with patch 0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
  (bsc#963964)</changelog>
<changelog author="hguo@suse.com" date="1455192000">- Remove krb5-mini pieces from spec file.
  Hence remove pre_checkin.sh
- Remove expired macros and other minor clean-ups in spec file.</changelog>
<changelog author="hguo@suse.com" date="1458734400">- Introduce patch
  0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  to fix CVE-2016-3119 (bsc#971942)</changelog>
<changelog author="hguo@suse.com" date="1459512000">- Upgrade from 1.14 to 1.14.1:
  * Remove expired patches:
    0104-Verify-decoded-kadmin-C-strings-CVE-2015-8629.patch
    0105-Fix-leaks-in-kadmin-server-stubs-CVE-2015-8631.patch
    0106-Check-for-null-kadm5-policy-name-CVE-2015-8630.patch
    krbdev.mit.edu-8301.patch
  * Replace source archives:
    krb5-1.14.tar.gz -&gt;
    krb5-1.14.1.tar.gz
    krb5-1.14.tar.gz.asc -&gt;
    krb5-1.14.1.tar.gz.asc
  * Adjust line numbers in:
    krb5-fix_interposer.patch</changelog>
<changelog author="michael@stroeder.com" date="1461844800">- removed obsolete patches:
  * 0107-Fix-LDAP-null-deref-on-empty-arg-CVE-2016-3119.patch
  * krb5-mechglue_inqure_attrs.patch
- Upgrade from 1.14.1 to 1.14.2:
  * Fix a moderate-severity vulnerability in the LDAP KDC back end that
    could be exploited by a privileged kadmin user [CVE-2016-3119]
  * Improve documentation
  * Fix some interactions with GSSAPI interposer mechanisms</changelog>
<changelog author="hguo@suse.com" date="1462881600">- Remove source file ccapi/common/win/OldCC/autolock.hxx
  that is not needed and does not carry an acceptable license.
  (bsc#968111)</changelog>
<changelog author="fcrozat@suse.com" date="1467288000">- Do no use systemd_requires macros in main package, it adds
  unneeded dependencies which pulls systemd into minimal chroot.
- Only call %insserv_prereq when building for pre-systemd
  distributions.
- Optimise some %post/%postun when only /sbin/ldconfig is called.</changelog>
<changelog author="idonmez@suse.com" date="1467460800">- Remove comments breaking post scripts.</changelog>
<changelog author="michael@stroeder.com" date="1469188800">- Upgrade from 1.14.2 to 1.14.3:
  * Improve some error messages
  * Improve documentation
  * Allow a principal with nonexistent policy to bypass the minimum
    password lifetime check, consistent with other aspects of
    nonexistent policies
  * Fix a rare KDC denial of service vulnerability when anonymous client
    principals are restricted to obtaining TGTs only [CVE-2016-3120]</changelog>
<changelog author="christof.hanke@rzg.mpg.de" date="1479124800">- add pam configuration file required for ksu
  just use a copy of "su" one from Tumbleweed</changelog>
<changelog author="michael@stroeder.com" date="1480766400">- Upgrade to 1.15
- obsoleted Patch7 (krb5-1.7-doublelog.patch) fixed in 1.12.2
- obsoleted patch to src/util/gss-kernel-lib/Makefile.in since
  file is not available in upstream source anymore
- obsoleted Patch15 (krb5-fix_interposer.patch) fixed in 1.15
- Upgrade from 1.14.4 to 1.15 - major changes:
  Administrator experience:
  * Add support to kadmin for remote extraction of current keys without
    changing them (requires a special kadmin permission that is excluded
    from the wildcard permission), with the exception of highly
    protected keys.
  * Add a lockdown_keys principal attribute to prevent retrieval of the
    principal's keys (old or new) via the kadmin protocol.  In newly
    created databases, this attribute is set on the krbtgt and kadmin
    principals.
  * Restore recursive dump capability for DB2 back end, so sites can
    more easily recover from database corruption resulting from power
    failure events.
  * Add DNS auto-discovery of KDC and kpasswd servers from URI records,
  in addition to SRV records.  URI records can convey TCP and UDP
  servers and master KDC status in a single DNS lookup, and can also
  point to HTTPS proxy servers.
  * Add support for password history to the LDAP back end.
  * Add support for principal renaming to the LDAP back end.
  * Use the getrandom system call on supported Linux kernels to avoid
    blocking problems when getting entropy from the operating system.
  * In the PKINIT client, use the correct DigestInfo encoding for PKCS
    [#1] signatures, so that some especially strict smart cards will work.
  Code quality:
  * Clean up numerous compilation warnings.
  * Remove various infrequently built modules, including some preauth
    modules that were not built by default.
  Developer experience:
  * Add support for building with OpenSSL 1.1.
  * Use SHA-256 instead of MD5 for (non-cryptographic) hashing of
    authenticators in the replay cache.  This helps sites that must
    build with FIPS 140 conformant libraries that lack MD5.
  Protocol evolution:
  * Add support for the AES-SHA2 enctypes, which allows sites to conform
    to Suite B crypto requirements.
- Upgrade from 1.14.3 to 1.14.4 - major changes:
  * Fix some rare btree data corruption bugs
  * Fix numerous minor memory leaks
  * Improve portability (Linux-ppc64el, FreeBSD)
  * Improve some error messages
  * Improve documentation</changelog>

</package>

</otherdata>