Affected: AlmaLinux:8: krb5-devel, AlmaLinux:8: krb5-libs, AlmaLinux:8: krb5-pkinit, AlmaLinux:8: krb5-server, AlmaLinux:8: krb5-server-ldap, AlmaLinux:8: krb5-workstation, AlmaLinux:8: libkadm5

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix:

* CVE-2025-24528 krb5: overflow when calculating ulog block size

Bug fix:

* kdb5_util: fix DB entry flags on modification

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected: Alpaquita:23: krb5, Alpaquita:25: krb5, Alpaquita:stream: krb5

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Affected: openEuler:22.03-LTS-SP3: krb5, openEuler:22.03-LTS-SP4: krb5, openEuler:24.03-LTS: krb5, openEuler:24.03-LTS-SP1: krb5, openEuler:20.03-LTS-SP4: krb5

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography. Security Fix(es):

In MIT krb5 release 1.7 and later with incremental propagation enabled, an authenticated attacker can cause kadmind to write beyond the end of the mapped region for the iprop log file, likely causing a process crash.(CVE-2025-24528)

krb5-1.21.3-2.1 on GA media

golang: net/http: net/http: sensitive headers incorrectly sent after cross-domain redirect libxml2: Use-After-Free in libxml2 crypto/internal/nistec: golang: Timing sidechannel for P-256 on ppc64le in crypto/internal/nistec krb5: overflow when calculating ulog block size libxml2: Stack-based buffer overflow in xmlSnprintfElements of libxml2

Security update for krb5

Affected: Ubuntu:Pro:14.04:LTS: krb5, Ubuntu:Pro:16.04:LTS: krb5, Ubuntu:Pro:18.04:LTS: krb5, Ubuntu:20.04:LTS: krb5, Ubuntu:22.04:LTS: krb5, Ubuntu:24.04:LTS: krb5, Ubuntu:25.10: krb5

In MIT Kerberos 5 (aka krb5) before 1.22 (with incremental propagation), there is an integer overflow for a large update size to resize() in kdb_log.c. An authenticated attacker can cause an out-of-bounds write and kadmind daemon crash.

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in MIT Kerberos ausnutzen, um einen Denial of Service Angriff durchzuführen.