-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3213-1 debian-...@lists.debian.org https://www.debian.org/lts/security/ Chris Lamb November 29, 2022 https://wiki.debian.org/LTS - -------------------------------------------------------------------------
Package : krb5 Version : 1.17-3+deb10u5 CVE ID : CVE-2022-42898 Debian Bug : 1024267 It was discovered that there was a potential Denial of Service (DoS) attack against krb5, a suite of tools implementing the Kerberos authentication system. An integer overflow in PAC parsing could have been exploited if a cross-realm entity acted maliciously. For Debian 10 buster, this problem has been fixed in version 1.17-3+deb10u5. We recommend that you upgrade your krb5 packages. For the detailed security status of krb5 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/krb5 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEEwv5L0nHBObhsUz5GHpU+J9QxHlgFAmOGICoACgkQHpU+J9Qx Hlhy2Q/6AkLgTgVjhmDglPwREzQhvCo3tSf0gzNBHDy1zl5yTNwJgTdUIIoI/v0D DFdVHakR8N1cy3pbiEY1swjG3simQLOITVmbf+DR1YZj3xaPrm0WUFUj5rEYcPG1 pgwIBmZFPayr85xQaBZHjboGTcK6s2U419QUrQN+JBEk3fFc6WsVO+818pP2mucn F/ar1B94+X6hzqjIxoeW+/j+9CC8bdcwsmokzKWRMbBZPTO5ebk648S/sLvoJWYF cBsVkAEDd6HzHd82P1z/p5UVEK1mKgK8TTTcW35qMyEjnqiRnJDiPg8cbU6oRwkv M+PyDcHg+X0WLa7LexUuCvSjL2B8sndGUfrGV50DjUwi0sQ5k/RsZq1y+K2HWkbB S5fmoTO9jyAXQMyiqxGaKbRYRPipXIb44H7nAIxc4Kvppqk7g7fic69+47+RBc7k rAzNJWmAv9mIHzx/xj4xX0mfEjGmAeVkiGvWiX7/H9le+cFhKgYn5HLqfiPfDqoa 8VKzoGpMxRnj8LxL0oj/4OU3PIL/4KOhRZb4vjGNk0Cbf1eqG51GEm7FiRu91s7e 912UOktqvmr2eRHlwmXLciE+tntYcpeg69zPE/O2VDS3KzuQD2rAu6x+q2CLIegP 7TC/7xjHr4/IhUE7jYQ0RFaCFi+hvbYeHdwGez4XbfoQKi1vR9A= =8kWo -----END PGP SIGNATURE-----