Bug 1188869

Summary:	CVE-2014-5352 CVE-2014-9421 CVE-2014-9423 CVE-2014-9422 krb5: various flaws [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Vincent Danen <vdanen>
Component:	krb5	Assignee:	Roland Mainz <rmainz>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	21	CC:	dpal, kerberos-dev-list, nalin, nathaniel, rharwood, rmainz
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	krb5-1.12.2-14.fc21	Doc Type:	Release Note
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2015-03-09 08:18:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1179856, 1179857, 1179861, 1179863

Description Vincent Danen 2015-02-03 21:38:07 UTC

This is an automatically created tracking bug!  It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.

For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.

For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs

When submitting as an update, use the fedpkg template provided in the next
comment(s).  This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.

Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.

NOTE: this issue affects multiple supported versions of Fedora. While only
one tracking bug has been filed, please correct all affected versions at
the same time.  If you need to fix the versions independent of each other,
you may clone this bug as appropriate.

[bug automatically created by: add-tracking-bugs]

Comment 1 Vincent Danen 2015-02-03 21:38:11 UTC

Use the following template to for the 'fedpkg update' request to submit an
update for this issue as it contains the top-level parent bug(s) as well as
this tracking bug.  This will ensure that all associated bugs get updated
when new packages are pushed to stable.

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=1179856,1188869

# Description of your update
notes=Security fix for CVE-2014-5352

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi update submission link instead:

https://admin.fedoraproject.org/updates/new/?type_=security&bugs=1179856,1188869

Comment 2 Vincent Danen 2015-02-03 21:38:24 UTC

Adding parent bug 1179857 (for CVE-2014-9421).  Please use this new fedpkg update template when submitting the update:

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=1188869,1179856,1179857

# Description of your update
notes=Security fix for CVE-2014-5352, CVE-2014-9421

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi update submission link instead:

https://admin.fedoraproject.org/updates/new/?type_=security&bugs=1188869,1179856,1179857

Comment 3 Vincent Danen 2015-02-03 21:38:35 UTC

Adding parent bug 1179861 (for CVE-2014-9422).  Please use this new fedpkg update template when submitting the update:

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=1188869,1179856,1179857,1179861

# Description of your update
notes=Security fix for CVE-2014-5352, CVE-2014-9421, CVE-2014-9422

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi update submission link instead:

https://admin.fedoraproject.org/updates/new/?type_=security&bugs=1188869,1179856,1179857,1179861

Comment 4 Vincent Danen 2015-02-03 21:38:46 UTC

Adding parent bug 1179863 (for CVE-2014-9423).  Please use this new fedpkg update template when submitting the update:

=====

# bugfix, security, enhancement, newpackage (required)
type=security

# testing, stable
request=testing

# Bug numbers: 1234,9876
bugs=1188869,1179856,1179857,1179861,1179863

# Description of your update
notes=Security fix for CVE-2014-5352, CVE-2014-9421, CVE-2014-9422, CVE-2014-9423

# Enable request automation based on the stable/unstable karma thresholds
autokarma=True
stable_karma=3
unstable_karma=-3

# Automatically close bugs when this marked as stable
close_bugs=True

# Suggest that users restart after update
suggest_reboot=False

======

Additionally, you may opt to use the bodhi update submission link instead:

https://admin.fedoraproject.org/updates/new/?type_=security&bugs=1188869,1179856,1179857,1179861,1179863

Comment 5 Tomas Hoger 2015-02-17 13:06:03 UTC

Should be fixed in 1.11.5-18 (F20) and 1.12.2-14 (F21), but not submitted as bodhi update.

Comment 6 Fedora Update System 2015-02-19 22:39:20 UTC

krb5-1.12.2-14.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/krb5-1.12.2-14.fc21

Comment 7 Fedora Update System 2015-02-19 22:41:17 UTC

krb5-1.11.5-18.fc20 has been submitted as an update for Fedora 20.
https://admin.fedoraproject.org/updates/krb5-1.11.5-18.fc20

Comment 8 Roland Mainz 2015-02-19 22:47:34 UTC

(In reply to Tomas Hoger from comment #5)
> Should be fixed in 1.11.5-18 (F20) and 1.12.2-14 (F21), but not submitted as
> bodhi update.

Erm... I did issue an $ fedkg update # for F21 and F20... I remember since I had to ask on IRC which password $ fedpkg update # again uses... I also double-checked ~/.sh_history (ksh93 history file) and the fedpkg update comment shows up there three times after the $ fedpkg build # commands...

... in any case I issued fedpkg update again:

# For F22
[test001@dhcp-80-169 krb5]$ fedpkg update
Creating a new update for  krb5-1.13-8.fc22 
krb5-1.13-8.fc22 not tagged as an update candidate

# for F21
[test001@dhcp-80-169 krb5]$ cd ../../f21/krb5
[test001@dhcp-80-169 krb5]$ fedpkg update
Creating a new update for  krb5-1.12.2-14.fc21 
Update successfully created
================================================================================
     krb5-1.12.2-14.fc21
================================================================================
    Release: Fedora 21
     Status: pending
       Type: security
      Karma: 0
    Request: testing
       Bugs: 1188869 - CVE-2014-5352 CVE-2014-9421 CVE-2014-9423 CVE-2014-9422
           : krb5: various flaws [fedora-all]
           : 1179856 - CVE-2014-5352 krb5:
           : gss_process_context_token() incorrectly frees context
           : (MITKRB5-SA-2015-001)
           : 1179857 - CVE-2014-9421 krb5: kadmind doubly frees
           : partial deserialization results (MITKRB5-SA-2015-001)
           : 1179861 - CVE-2014-9422 krb5: kadmind incorrectly
           : validates server principal name (MITKRB5-SA-2015-001)
           : 1179863 - CVE-2014-9423 krb5: libgssrpc server
           : applications leak uninitialized bytes
           : (MITKRB5-SA-2015-001)
      Notes: Security fix for CVE-2014-5352, CVE-2014-9421, CVE-2014-9422,
           : CVE-2014-9423
  Submitter: gisburn
  Submitted: 2015-02-19 22:39:13
   Comments: bodhi - 2015-02-19 22:39:24 (karma 0)
             This update has been submitted for testing by gisburn.

  https://admin.fedoraproject.org/updates/krb5-1.12.2-14.fc21

# for F20:
[test001@dhcp-80-169 krb5]$ cd ../../f20/krb5/
[test001@dhcp-80-169 krb5]$ fedpkg update
Creating a new update for  krb5-1.11.5-18.fc20 
Update successfully created. This update has obsoleted krb5-1.11.5-16.fc20, and has inherited its bugs and notes.
================================================================================
     krb5-1.11.5-18.fc20
================================================================================
    Release: Fedora 20
     Status: pending
       Type: security
      Karma: 0
    Request: testing
       Bugs: 1188869 - CVE-2014-5352 CVE-2014-9421 CVE-2014-9423 CVE-2014-9422
           : krb5: various flaws [fedora-all]
           : 1179856 - CVE-2014-5352 krb5:
           : gss_process_context_token() incorrectly frees context
           : (MITKRB5-SA-2015-001)
           : 1179857 - CVE-2014-9421 krb5: kadmind doubly frees
           : partial deserialization results (MITKRB5-SA-2015-001)
           : 1179861 - CVE-2014-9422 krb5: kadmind incorrectly
           : validates server principal name (MITKRB5-SA-2015-001)
           : 1179863 - CVE-2014-9423 krb5: libgssrpc server
           : applications leak uninitialized bytes
           : (MITKRB5-SA-2015-001)
           : 1145425 - CVE-2014-5351 krb5: current keys returned
           : when randomizing the keys for a service principal
           : 1145426 - CVE-2014-5351 krb5: current keys returned
           : when randomizing the keys for a service principal
           : [fedora-all]
      Notes: Security fix for CVE-2014-5352, CVE-2014-9421, CVE-2014-9422,
           : CVE-2014-9423 Security fix for CVE-2014-5351
  Submitter: gisburn
  Submitted: 2015-02-19 22:40:12
   Comments: bodhi - 2015-02-19 22:41:24 (karma 0)
             This update has been submitted for testing by gisburn.

  https://admin.fedoraproject.org/updates/krb5-1.11.5-18.fc20

... is this correct now ?

P.S.: How can we track why the original update request didn't work (timeframe can be narrowed down to the hour when the builds finished) ?

Comment 9 Fedora Update System 2015-02-21 04:23:35 UTC

Package krb5-1.12.2-14.fc21:
* should fix your issue,
* was pushed to the Fedora 21 testing repository,
* should be available at your local mirror within two days.
Update it with:
# su -c 'yum update --enablerepo=updates-testing krb5-1.12.2-14.fc21'
as soon as you are able to.
Please go to the following url:
https://admin.fedoraproject.org/updates/FEDORA-2015-2347/krb5-1.12.2-14.fc21
then log in and leave karma (feedback).

Comment 10 Fedora Update System 2015-03-09 08:18:06 UTC

krb5-1.11.5-18.fc20 has been pushed to the Fedora 20 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 11 Fedora Update System 2015-03-12 16:33:36 UTC

krb5-1.12.2-14.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.