security/krb5-122: Update to 1.22.3HEADmain

This is a bug fix release, with a focus on security issues discovered
with the aid of large language models.  See
https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt for
information on the risks of continuing to use unpatched releases.

* Fix a logic error when checking PAC server checksums
   [CVE-2026-111423].

* Check for unkeyed checksums when validating CAMMAC verifiers
   [CVE-2026-71199].

* Fix a loophole in the KDC's client authdata filtering which could
   allow clients to include fake PAC and CAMMAC authdata values when
   requesting service tickets.  These fake values would be rejected by
   application servers, were it not for the two bugs noted above.

* Check for the lockdown_keys attribute when processing password
   change protocol requests in kadmind [CVE-2026-107884].

* In libgssrpc, when processing RPC messages using the RPCSEC_GSS
   flavor, use the verified service type included in the RPC request to
   determine how to unwrap arguments and wrap return values, instead of
   the unverified service type included during authentication
   [CVE-2026-118380].

* In libgssrpc, disable the AUTH_GSSAPI server auth flavor unless the
   "GSSRPC_ALLOW_AUTH_GSSAPI" environment variable is set.  AUTH_GSSAPI
   is only needed for very old (pre-1.4) clients [CVE-2026-112322]
   [CVE-2026-112323].

* Fix numerous null pointer deferences, read overruns, unbounded
   memory allocations, and memory leaks that could be used as denial of
   service attacks against the KDC, kadmind, application servers, or
   client programs [CVE-2026-40355] [CVE-2026-40356] [CVE-2026-71200]
   [CVE-2026-107364] [CVE-2026-107708] [CVE-2026-107778]
   [CVE-2026-112314] [CVE-2026-112315] [CVE-2026-112316]
   [CVE-2026-112317] [CVE-2026-112318] [CVE-2026-112319]
   [CVE-2026-112320] [CVE-2026-112321] [CVE-2026-112323]
   [CVE-2026-119079].

* Fix a client crash when a KKDCP proxy daemon closes the TLS session
   without supplying any response data.

* Shut down kpropd gracefully when a termination signal is received,
   when operating in incremental propagation mode.

* Detect when an incremental propagation update is applied to a
   nonexistent principal; when this happens, force a full resync
   instead of crashing.

* Fix a KDC crash when the LDAP KDB module loses its connection to the
   LDAP server.

* Avoid a crash on macOS when the native API ccache type is used
   before and after forking a process.

* When an application accepts a GSS context without asking for
   delegated credentials, discard any credentials sent by the initiator
   without parsing them first.

Security:	https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2026-001.txt
MFH:		2026Q4

0 files changed, 0 insertions, 0 deletions