krb5 - Debian Package Tracker

general

source: krb5 (main)
version: 1.22.1-3
maintainer: Sam Hartman (DMD)
uploaders: Russ Allbery (DMD) – Benjamin Kaduk (DMD)
arch: all any
std-ver: 4.7.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.18.3-6+deb11u5
o-o-sec: 1.18.3-6+deb11u8
o-o-p-u: 1.18.3-6+deb11u5
oldstable: 1.20.1-2+deb12u5
old-sec: 1.20.1-2+deb12u5
old-p-u: 1.20.1-2+deb12u5
stable: 1.21.3-5+deb13u1
stable-sec: 1.21.3-5+deb13u1
testing: 1.22.1-3
unstable: 1.22.1-3

versioned links

1.18.3-6+deb11u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.18.3-6+deb11u8: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.20.1-2+deb12u5: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.21.3-5+deb13u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.22.1-3: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

krb5-admin-server (5 bugs: 0, 4, 1, 0)
krb5-doc (2 bugs: 0, 1, 1, 0)
krb5-gss-samples
krb5-k5tls
krb5-kdc
krb5-kdc-ldap (1 bugs: 0, 1, 0, 0)
krb5-kpropd
krb5-locales (1 bugs: 0, 1, 0, 0)
krb5-multidev (1 bugs: 0, 0, 1, 0)
krb5-otp
krb5-pkinit
krb5-user (3 bugs: 0, 1, 2, 0)
libgssapi-krb5-2 (3 bugs: 0, 3, 0, 0)
libgssrpc4t64
libk5crypto3 (1 bugs: 0, 1, 0, 0)
libkadm5clnt-mit12
libkadm5srv-mit12
libkdb5-10t64
libkrad-dev
libkrad0
libkrb5-3 (3 bugs: 0, 2, 1, 0)
libkrb5-dbg
libkrb5-dev (2 bugs: 0, 1, 1, 0)
libkrb5support0 (1 bugs: 0, 1, 0, 0)

action needed

A new upstream version is available: 1.22.3 high

A new upstream version 1.22.3 is available, you should consider packaging it.

Created: 2026-02-02 Last update: 2026-11-13 21:00

19 security issues in trixie high

There are 19 open security issues in trixie.

17 important issues:

CVE-2026-71199:
CVE-2026-71200:
CVE-2026-107364:
CVE-2026-107884:
CVE-2026-111423:
CVE-2026-112314: clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
CVE-2026-112315: The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
CVE-2026-112316: xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
CVE-2026-112317: krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
CVE-2026-112318: The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
CVE-2026-112319: The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
CVE-2026-112320: The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
CVE-2026-112321: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
CVE-2026-112322: clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
CVE-2026-112323: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
CVE-2026-118380:
CVE-2026-119079: decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

2 issues left for the package maintainer to handle:

CVE-2026-107708: (needs triaging) MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
CVE-2026-107778: (needs triaging) MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

You can find information about how to handle these issues in the security team's documentation.

Created: 2026-10-09 Last update: 2026-11-10 12:31

19 security issues in sid high

There are 19 open security issues in sid.

19 important issues:

CVE-2026-71199:
CVE-2026-71200:
CVE-2026-107364:
CVE-2026-107708: MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
CVE-2026-107778: MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
CVE-2026-107884:
CVE-2026-111423:
CVE-2026-112314: clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
CVE-2026-112315: The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
CVE-2026-112316: xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
CVE-2026-112317: krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
CVE-2026-112318: The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
CVE-2026-112319: The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
CVE-2026-112320: The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
CVE-2026-112321: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
CVE-2026-112322: clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
CVE-2026-112323: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
CVE-2026-118380:
CVE-2026-119079: decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

Created: 2026-10-09 Last update: 2026-11-10 12:31

19 security issues in forky high

There are 19 open security issues in forky.

19 important issues:

CVE-2026-71199:
CVE-2026-71200:
CVE-2026-107364:
CVE-2026-107708: MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
CVE-2026-107778: MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.
CVE-2026-107884:
CVE-2026-111423:
CVE-2026-112314: clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
CVE-2026-112315: The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
CVE-2026-112316: xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
CVE-2026-112317: krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
CVE-2026-112318: The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
CVE-2026-112319: The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
CVE-2026-112320: The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
CVE-2026-112321: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
CVE-2026-112322: clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
CVE-2026-112323: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
CVE-2026-118380:
CVE-2026-119079: decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

Created: 2026-10-09 Last update: 2026-11-10 12:31

19 security issues in bookworm high

There are 19 open security issues in bookworm.

17 important issues:

CVE-2026-71199:
CVE-2026-71200:
CVE-2026-107364:
CVE-2026-107884:
CVE-2026-111423:
CVE-2026-112314: clnttcp_call() in lib/rpc/clnt_tcp.c in MIT Kerberos 5 (aka krb5) does not free the RPC reply verifier between retries, which allows remote attackers to cause a denial of service (memory leak in GSS-RPC client programs) by injecting RPC replies with mismatched XIDs or by triggering authentication retries.
CVE-2026-112315: The RPCSEC_GSS authentication routines in lib/rpc/authgss_prot.c in MIT Kerberos 5 (aka krb5) 1.4 and later do not free partially decoded buffers on failure, which allows remote attackers to cause a denial of service (memory leak in kadmind) via crafted RPCSEC_GSS messages.
CVE-2026-112316: xdr_krb5_tl_data() in lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) does not free partially decoded data on failure, which allows remote authenticated users to cause a denial of service (memory leak in kadmind) via crafted RPC requests that trigger a decode failure.
CVE-2026-112317: krb5_ktkdb_get_entry() in lib/kdb/keytab.c in MIT Kerberos 5 (aka krb5) 1.2.8 and later does not free decrypted key material when a post-decryption check fails, which allows remote attackers to cause a denial of service (memory leak in the KDC or kadmind) via requests that repeatedly trigger key decryption failures.
CVE-2026-112318: The policy RPC stubs in kadmin/server/server_stubs.c in MIT Kerberos 5 (aka krb5) 1.5.3 and later do not reject a NULL policy name decoded by xdr_nullstring(), which allows remote authenticated users to cause a denial of service (kadmind crash via NULL pointer dereference) by sending a policy request with an empty policy name that reaches authorization checks or logging code.
CVE-2026-112319: The GSS-RPC layer in MIT Kerberos 5 (aka krb5) does not enforce size limits on XDR-decoded data, which allows remote authenticated users to cause a denial of service (memory exhaustion or excessive CPU consumption in kadmind) via crafted RPC requests that trigger unbounded memory allocations during XDR decoding.
CVE-2026-112320: The GSS-RPC transport layer in MIT Kerberos 5 (aka krb5) 1.4 and later does not release the previous authentication context when a client switches from an RPCSEC_GSS or AUTH_GSSAPI flavor to a non-GSS flavor on the same TCP connection. This allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by repeatedly establishing and abandoning GSS authentication contexts.
CVE-2026-112321: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) does not free decoded arguments on certain error paths, which allows remote attackers to cause a denial of service (memory exhaustion in kadmind) via crafted AUTH_GSSAPI_INIT requests that trigger authentication failures.
CVE-2026-112322: clean_client() in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) restarts its scan from the head of the client list after each removal, resulting in quadratic CPU cost. Remote attackers can cause a denial of service (CPU consumption in kadmind) by accumulating a large number of AUTH_GSSAPI client entries.
CVE-2026-112323: The AUTH_GSSAPI handler in lib/rpc/svc_auth_gssapi.c in MIT Kerberos 5 (aka krb5) 1.5.2 and later allows remote attackers to cause a denial of service (memory exhaustion in kadmind) by sending repeated failed AUTH_GSSAPI_INIT requests. Each failed request allocates client state that is only freed after a 15-minute expiration timeout, allowing an attacker to accumulate memory faster than it is reclaimed.
CVE-2026-118380:
CVE-2026-119079: decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.

2 issues postponed or untriaged:

CVE-2026-107708: (postponed; to be fixed through a stable update) MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
CVE-2026-107778: (postponed; to be fixed through a stable update) MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows authenticated Kerberos clients to crash services by sending mismatched KRB-CRED arrays. Attackers can send forwarded credentials with more tickets than ticket_info entries through gss_accept_sec_context() to crash GSS-API acceptor services, causing denial of service.

Created: 2026-11-10 Last update: 2026-11-10 12:31

lintian reports 63 warnings high

Lintian reports 63 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2024-07-06 Last update: 2026-09-13 12:00

5 security issues in buster high

There are 5 open security issues in buster.

2 important issues:

CVE-2024-37370: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
CVE-2024-37371: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

3 issues postponed or untriaged:

CVE-2024-26458: (needs triaging) Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
CVE-2024-26461: (needs triaging) Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
CVE-2024-26462: (needs triaging) Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

Created: 2024-06-27 Last update: 2024-06-29 05:38

4 bugs with a patch to review in the bug tracker normal

The bug tracker contains patches fixing 4 bugs to review: include them, or remove the patch tag.

Created: 2026-09-02 Last update: 2026-11-13 21:30

Fails to build during reproducibility testing normal

A package building reproducibly enables third parties to verify that the source matches the distributed binaries. It has been identified that this source package produced different results, failed to build or had other issues in a test environment. Please read about how to improve the situation!

Created: 2026-07-16 Last update: 2026-11-13 19:30

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.22.3-1, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 8f577a2d9c088ce49da0f9b16ae98520d9d4bb21
Author: Sam Hartman <hartmans@debian.org>
Date:   Wed Nov 11 05:18:38 2026 -0700

    Update 1.22.3-1 changelog: record security fixes, target UNRELEASED
    
    New upstream 1.22.3 fixes 17 CVEs (Closes: #1153598). Target the UNRELEASED distribution; create the debian/1.22.3-1 tag only when the release is finalized.

commit 759aef8028ab74f96d97d5bf4de97585c011c51b
Author: Sam Hartman <hartmans@debian.org>
Date:   Wed Nov 11 05:16:42 2026 -0700

    Rediff patches
    
    Add 0012-Use-X509_check_host-to-verify-KKDCP-server-cert.patch: <REASON>
    Drop 0016-PATCH-Prevent-read-overrun-in-libkdb_lda.patch: <REASON>
    Drop 0015-Use-X509_check_host-to-verify-KKDCP-server-cert.patch: <REASON>
    Drop 0014-Improve-future-OpenSSL-compatibility.patch: <REASON>
    Drop 0013-Fix-two-NegoEx-parsing-vulnerabilities.patch: <REASON>
    Drop 0013-Fix-strchr-conformance-to-C23.patch: <REASON>

commit b551567af46bf1457aa51ca286051ae5f3e9adb8
Author: Sam Hartman <hartmans@debian.org>
Date:   Wed Nov 11 04:56:35 2026 -0700

    Update symbols files for new upstream
    
    - libkrb5-3: add k5_ser_unpack_len (new in upstream 1.22.3)
    - libkrb5support0: drop krb5int_strlcat/krb5int_strlcpy (removed upstream; benign)

commit 42d007ca5a49beed0027a436868d21faa7db786e
Author: Sam Hartman <hartmans@debian.org>
Date:   Wed Nov 11 03:58:02 2026 -0700

    Update changelog for 1.22.3-1 release

commit 0940f1a392e314993e3324da00a165ffa7a16d49
Merge: 935d28e 7d65daf
Author: Sam Hartman <hartmans@debian.org>
Date:   Wed Nov 11 03:03:39 2026 -0700

    Update upstream source from tag 'upstream/1.22.3'
    
    Update to upstream version '1.22.3'
    with Debian dir 7e62f2495861b49590cdb663c2f4dcdd1ea32266

commit 935d28ecc7b019b895fcadb7ae50c9be991816ab
Author: Wesley Hershberger <wesley.hershberger@canonical.com>
Date:   Wed Sep 16 12:47:39 2026 -0500

    krb5_newrealm: Use systemd
    
    Signed-off-by: Wesley Hershberger <wesley.hershberger@canonical.com>

commit 09274e6722880f5ee30a10119a490b6e6b39776d
Author: Sam Hartman <hartmans@debian.org>
Date:   Fri Jun 19 08:32:09 2026 -0600

    Document changes

commit 3a2cbe3be89e8103decdfbed3959332ac988bb99
Author: Emmanuel Arias <eamanu@debian.org>
Date:   Wed Jun 17 21:23:20 2026 -0300

    Non-maintainer upload.
    
    * Non-maintainer upload.
    * CVE-2026-11850: Prevent read overrun in libkdb_ldap (Closes: #1139821).

commit 67164b70a9547b864c0253f28cc215dbc0777d21
Author: Sam Hartman <hartmans@debian.org>
Date:   Mon Jun 8 09:48:34 2026 -0600

    Upstream commit f5bbfa4 to use openssl facilities to verify certificates; needed to avoid discarding const qualifier from Openssl 4.0 patch

commit 451d03b4c426089d8d88378b5bbd998bcbf952f5
Author: Sam Hartman <hartmans@debian.org>
Date:   Mon Jun 8 09:21:29 2026 -0600

    Upstream patch for OpenSSL 4.0 compatibility, Closes: #1138466

commit 93070a96c5da3a84d066ed88916286f34634b7ae
Author: Sam Hartman <hartmans@debian.org>
Date:   Mon Jun 8 07:23:25 2026 -0600

    Remove lintian tag that ldap plugin is linked against libc6; no longer needed

commit 6f89ca77e5eaa5d26840c4a3110e25ad77453781
Author: Sam Hartman <hartmans@debian.org>
Date:   Mon May 25 16:33:55 2026 -0600

    Fix C23 use of strchr, Closes: #1128877

commit ed2f768c3cedeca6ee1cd6c900bf4cb57095b567
Merge: 8e1a790 b0b5c75
Author: Salvatore Bonaccorso <carnil@debian.org>
Date:   Tue May 12 20:18:46 2026 +0200

    Merge branch 'debian-1135317' into 'master'
    
    Fix two NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    
    See merge request debian/krb5!13

commit b0b5c7523aaa482c0d4158a87b5431d417b4979a
Author: Salvatore Bonaccorso <carnil@debian.org>
Date:   Sun May 10 09:08:42 2026 +0200

    Prepare changelog for release
    
    Gbp-Dch: Ignore

commit dd0338d94a319f616f9d59ce7505bb921ee99b3c
Author: Salvatore Bonaccorso <carnil@debian.org>
Date:   Sun May 10 09:06:31 2026 +0200

    Fix two NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    
    Closes: #1135317

commit 8e1a7905ef7505cb7bfa90de44578666e8496a6b
Author: Sam Hartman <hartmans@debian.org>
Date:   Fri Nov 14 08:19:38 2025 -0700

    Release to unstable

commit 0089d227887773229b4b3d372bcb1e1db300b582
Author: Sam Hartman <hartmans@debian.org>
Date:   Tue Oct 7 16:30:36 2025 -0600

    Release to experimental

commit b85a2c904b9c849202f44852202fda3ced9ffc82
Author: Sam Hartman <hartmans@debian.org>
Date:   Tue Oct 7 15:09:39 2025 -0600

    Update symbols files

commit 42f01a00b4781e91f531e8c85f911bc19c5cdb06
Author: Sam Hartman <hartmans@debian.org>
Date:   Fri Oct 3 08:40:27 2025 -0600

    New upstream version

commit 61c960c38dfaeb0801f2f7d743d32fc79f2a193a
Merge: d26e8df b8a2cc7
Author: Sam Hartman <hartmans@debian.org>
Date:   Fri Oct 3 08:33:17 2025 -0600

    Update upstream source from tag 'upstream/1.22.1'
    
    Update to upstream version '1.22.1'
    with Debian dir 7a175a5ae70e96bb3eea7902af4218fd18e8fa07

commit d26e8df8ee220af0f2361a66d2d357762aff1c3e
Author: Bastien Roucariès <rouca@debian.org>
Date:   Thu Mar 13 00:05:00 2025 +0000

    Add NMU

commit 95d2a58e6836348e4c142ac8c45d255b2a23110c
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Feb 23 17:12:28 2025 +0000

    CVE-2025-24528

commit 08e28302d307eb15643cea2a79437b4667340e15
Author: Bastien Roucariès <rouca@debian.org>
Date:   Sun Feb 23 17:10:11 2025 +0000

    Mark CVE-2024-26462 as fixed in 1.21.3-1
    
    Upstream fix it but forget to mention in changelog

commit 4c3f2940e40e49a98e66efdba7cc64393df10d64
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jan 16 11:27:54 2025 -0700

    Document changes for -4

commit 68d72d0293632024ca344cce57648eb282042a2b
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jan 16 11:20:19 2025 -0700

    Do not set ownership in debian/rules so we can work without fakeroot,
    Thanks Guillem Jover for patch and for pointing out that setuid for
    ksu will still work, Closes: #1092384

commit 297b3d2eaeeae06b04a052ab0475411f6923510f
Author: Sam Hartman <hartmans@debian.org>
Date:   Tue Jan 7 15:32:36 2025 -0700

    fix typo

commit eb261a83a8d994cc2bc6ada998f75b3699d16080
Author: Sam Hartman <hartmans@debian.org>
Date:   Tue Jan 7 13:49:36 2025 -0700

    Rules-Requires-Root: binary-targets required for ksu, Closes: #1092384

commit 2eae1e906e9c0f827e325a362d8c426d76ca38d3
Merge: 031938d d6253a3
Author: Benjamin Kaduk <kaduk@mit.edu>
Date:   Thu Jul 25 05:06:13 2024 +0000

    Merge branch 'master' into 'master'
    
    fix bug closing syntax
    
    See merge request debian/krb5!11

commit d6253a3c367d80f881a1ba7e6ec121de2cbb41f9
Author: Fabio Pedretti <pedretti.fabio@gmail.com>
Date:   Wed Jul 24 11:35:32 2024 +0200

    fix bug closing syntax

commit 031938db0374176e299de42979588481d47da1a3
Author: Sam Hartman <hartmans@debian.org>
Date:   Fri Jul 5 11:26:55 2024 -0600

    Document changes for 1.21.3-3

commit b7bbb8a52401b17ec158e8d9010e63410dcaea2c
Author: Sam Hartman <hartmans@debian.org>
Date:   Fri Jul 5 10:42:52 2024 -0600

    Fix sysconfdir in call to configure, broken in previous upload

commit 168d720949ed9ca196c2e01543b56adf93a5f575
Author: Sam Hartman <hartmans@debian.org>
Date:   Wed Jul 3 13:47:23 2024 -0600

    Document changes

commit 19e4f6c4d4de387e1b4c7be3a13f255cefc2b64c
Author: Sam Hartman <hartmans@debian.org>
Date:   Wed Jul 3 13:46:44 2024 -0600

    use libnss-myhostname to guarantee we have a hostname for builds, Closes: #1063648

commit 2c0f3af76b1aa32f09aa1b964fd0772a8f1850ab
Author: Sam Hartman <hartmans@debian.org>
Date:   Wed Jul 3 13:43:42 2024 -0600

    Enable lmdb database, Closes: ##1075723

commit b9047276e354b48cbd969ee20a259f10327a023b
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 27 11:55:56 2024 -0600

    Release 1.21.3-1 to unstable

commit 3475516d134f9a72a794ff2d074119a079f4cc30
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 27 11:25:04 2024 -0600

    Fix Python 3.12 tests: replace ssl.wrap_socket, Closes: #1067610

commit aa4c65da7c9d96b1920694aab5cd3bcf3a1f0edc
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 27 10:11:12 2024 -0600

    Upstream version 1.21.3; rebase patches

commit f5d65e5cff3d70c2304c579e14c1ef23e561c12b
Merge: 625ddbd e9ee894
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 27 10:01:50 2024 -0600

    Update upstream source from tag 'upstream/1.21.3'
    
    Update to upstream version '1.21.3'
    with Debian dir ab13beae92739457977e166816524c12088c6008

commit 625ddbdfd93a8d1688d7c23420e9cbd12eb46d32
Author: Sam Hartman <hartmans@debian.org>
Date:   Mon Jun 17 10:50:16 2024 -0600

    release to unstable

commit b104eb94903e6610ae02b06b8217c1ede92614b5
Author: Sam Hartman <hartmans@debian.org>
Date:   Fri Jun 14 16:42:35 2024 -0600

    New patches:
    
    * Allow kpropd to bind even if only loopback is configured, Closes: #1072952
      * Skip keyring tests if keyring blocked by seccomp

commit 7153eb67f2d10cd1bfb51da70aafae763c2c70b9
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 13 15:21:24 2024 -0600

    Update symbols and breaks for internal APIs that were removed

commit 340b40ff635017ebdad3ae6217bde7303a2161a4
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 13 13:52:06 2024 -0600

    Document changes and rebuild patch series

commit 1f1f8814d55b567bd20a90b63103f16b9d4a0fa1
Merge: 2530b0e 3230ee1
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 13 13:40:04 2024 -0600

    Update upstream source from tag 'upstream/1.21.2'
    
    Update to upstream version '1.21.2'
    with Debian dir a6cafbaf18c3322f856027b98ee019b4b6775b18

commit 2530b0ec98f247c8d2c85be8cdfa72f7b3a28213
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 13 13:30:21 2024 -0600

     Install systemd unit overrides into /usr. (DEP17 M2). Closes: #1072915

commit fac3fb55ebdcb69e46e382a278e8ace9dd047b30
Merge: 58a4950 c0bcbe8
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 6 16:31:58 2024 -0600

    Merge in janitor fixes.

commit 58a4950c8fbd59c700033f1598c165e8641cc577
Merge: 9625ea4 4ab5365
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Jun 6 21:31:45 2024 +0000

    Merge branch 'salsa-ci' into 'master'
    
    Enable Salsa-CI in source package krb5
    
    See merge request debian/krb5!9

commit 4ab53658cadcf63d05308c5d374171bf34396174
Author: Otto Kekäläinen <otto@debian.org>
Date:   Sat Jun 3 16:37:51 2023 -0700

    Enable Salsa-CI
    
    This will help ensure easily machine detectable regressions don't slip
    into the code base.
    
    This also makes any future contribution process faster and more
    reliable, as any contributor submitting a Merge Request will get
    immediate feedback, and the maintainers save time by not having to point
    out basic mistakes.
    
    Package krb5 build passes on all but three jobs out-of-the-box. The
    crossbuild-arm64 is allowed to fail by default in Salsa-CI. Additionally
    allow reprotest fail initially until they are fixed for this package.
    The blhc check has two specific false positive overrides to pass.

commit 9625ea4039869f960aab9a013cc2394a6dcfadd0
Author: Otto Kekäläinen <otto@debian.org>
Date:   Sun May 14 12:37:36 2023 -0700

    Make package Lintian clean
    
    Add overrides to remaining Lintian errors after validating it make sense
    to do so. After this Lintian will not yield Lintian errors (only warnings)
    and thus also Salsa-CI Lintian job can be enabled and enforced.

commit 9aeb9d9bc4660c010506d026dfea15cf7a37a055
Author: Otto Kekäläinen <otto@debian.org>
Date:   Sun May 19 13:21:17 2024 -0700

    Drop obsolete dependency on package lsb-base
    
    The package is now empty and no longer used. This fixes Lintian errors:
    
        E: krb5-admin-server: depends-on-obsolete-package Depends: lsb-base (>= 3.0-6)
        E: krb5-kdc: depends-on-obsolete-package Depends: lsb-base (>= 3.0-6)
        E: krb5-kpropd: depends-on-obsolete-package Depends: lsb-base
    
    The functionality of lsb-base is in the Essential:yes set since
    Bullseye. The package itself is now an empty transitional package
    (because debootstrap doesn't understand the Provides relationship) which
    depends on the new provider of the functionality, sysvinit-utils, which
    is also in the Essential:yes set.
    
    More information in
    https://lists.debian.org/debian-devel/2023/01/msg00150.html
    and https://tracker.debian.org/media/packages/l/lsb/changelog-11.5

commit 948c5d7308cb345e9c4a086bf4b71c91209b13ff
Author: Otto Kekäläinen <otto@debian.org>
Date:   Sun May 19 13:20:00 2024 -0700

    Run 'wrap-and-sort'
    
    Skip running full wrap-and-sort with '-a' in in debian/control as
    maintainer indicated in
    https://salsa.debian.org/debian/krb5/-/merge_requests/5#note_246097
    preference to have file unchanged despite inconsistent syntax.
    
    Maintainer did however later apply wrap-and-sort in f21251ec and 15ffa3e6,
    so finalize that following the same convetion with this change.

commit 7905b1524c6c50459b513c004ea7c4fff6a625c6
Author: Sam Hartman <hartmans@debian.org>
Date:   Sun Mar 10 19:38:13 2024 -0600

    Fix up libverto1*->libverto1*t64, Closes: #1065702

commit e0c65588e32f4dda9347fb92ff85402e181e27f3
Author: Sam Hartman <hartmans@debian.org>
Date:   Sun Mar 10 19:34:27 2024 -0600

    Rename libraries for 64-bit time_t transition.  Closes: #1064164

commit 25554003fd72b064a7abb2db514197728e84f09a
Author: Sam Hartman <hartmans@debian.org>
Date:   Tue Oct 24 06:51:06 2023 -0600

    Annotate test dependencies <!nocheck>. (Closes: #1054461)
    
    * Annotate test dependencies <!nocheck>. (Closes: #1054461)
    * Fix keyutils to be linux-any

commit 73ec2403a3ee848a2597699a6e32b014f9ee6881
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Sep 14 10:27:27 2023 -0600

    Work around doxygen change that breaks doc build, Thanks Greg Hudson, Closes: #1051523

commit c0bcbe820e0dfcfbb15214da41a254d9f5ac0642
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Mon Jan 30 08:44:00 2023 +0000

    Remove constraints unnecessary since buster (oldstable)
    
    * Build-Depends: Drop versioned constraint on libverto-dev (>= 0.2.4).
    * krb5-kdc: Drop versioned constraint on lsb-base (>= 3.0-6) in Depends.
    * krb5-admin-server: Drop versioned constraint on krb5-kdc (>= 1.10+dfsg~) in Depends.
    * krb5-admin-server: Drop versioned constraint on lsb-base (>= 3.0-6) in Depends.
    * krb5-kpropd: Drop conflict with removed package krb5-kdc (<< 1.15.1-3~) in Replaces.
    * libkrb5-dev: Drop conflict with removed package krb5-multidev (<< 1.8+dfsg~alpha1-3) in Replaces.
    * krb5-pkinit: Drop conflict with removed package krb5-kdc (<< 1.14+dfsg) in Breaks.
    * krb5-otp: Drop versioned constraint on libkrb5-3 (>= 1.12~alpha1+dfsg-1~) in Depends.
    * krb5-k5tls: Drop versioned constraint on libkrb5-3 (>= 1.13~alpha1+dfsg~) in Depends.
    * libkrb5-3: Drop conflict with removed package sssd (<= 1.2.1-4.3) in Breaks.
    * libkrb5-3: Drop conflict with removed package libsmbclient (<= 2:3.6.1-2) in Breaks.
    * libgssapi-krb5-2: Drop conflict with removed package moonshot-gss-eap (<= 1.0) in Breaks.
    * libkdb5-10: Drop conflict with removed package krb5-kdc (= 1.13~alpha1+dfsg-1) in Breaks.
    * libkrad-dev: Drop versioned constraint on libverto-dev (>= 0.2.4) in Depends.
    * libkrad-dev: Drop conflict with removed package libkrb5-dev (<< 1.12+dfsg-2) in Replaces.
    * libkrad-dev: Drop conflict with removed package krb5-multidev (<< 1.12+dfsg-2) in Breaks.
    * libkrad-dev: Drop conflict with removed package libkrb5-dev (<< 1.12+dfsg-2) in Breaks.
    
    Changes-By: deb-scrub-obsolete

commit 411d23f7767023cabf2ed40482f9e9bb2c8a27f2
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Nov 17 10:40:08 2022 -0700

    krb5-user recommends not depends krb5-config

commit 5a586d13919c50344b1155615b305454e2bf4781
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Nov 17 10:35:36 2022 -0700

    Document changes for 1.20.1

commit a1fad1e10429179275e62579039051d8017bb071
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Nov 17 10:35:22 2022 -0700

    Tighten dependencies to account for removal of internal prng in 1.19

commit 2bf35b5aa2d1c23244c5c643a1dc7964b95e1a2a
Merge: d974c48 dab5125
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Nov 17 10:16:32 2022 -0700

    Update upstream source from tag 'upstream/1.20.1'
    
    Update to upstream version '1.20.1'
    with Debian dir 436d9a4e73accaf411b8f98079d2e8430d7ac928

commit d974c48dfff37b2579dc4ad4d54bd2c9e35a1934
Author: Sam Hartman <hartmans@debian.org>
Date:   Thu Nov 17 10:14:26 2022 -0700

    Document janitor changes

commit d31f16a55d88e7bcc3aec68d23318261866a97a8
Merge: 39eb1e6 440462b
Author: Jelmer Vernooĳ <jelmer@debian.org>
Date:   Tue Nov 1 13:51:01 2022 +0000

    Merge branch 'lintian-fixes' into 'master'
    
    Fix some issues reported by lintian
    
    See merge request debian/krb5!7

commit 440462bd27420463f5cf87ca8b1a1f7f18f379ef
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Wed Oct 5 00:24:48 2022 +0000

    Fix field name cases in debian/control (VCS-Browser => Vcs-Browser, VCS-Git => Vcs-Git).
    
    Changes-By: lintian-brush
    Fixes: lintian: cute-field
    See-also: https://lintian.debian.org/tags/cute-field.html

commit 39eb1e63a2553a2a0dbf414d4a6042c81debeb46
Author: Bastian Germann <bage@debian.org>
Date:   Sun Aug 14 18:21:14 2022 +0200

    Sync debian/copyright with NOTICE from upstream
    
    The RFC's license is not included anymore.
    Add two new license notices.

Created: 2026-09-19 Last update: 2026-11-12 20:30

debian/patches: 16 patches to forward upstream low

Among the 16 debian patches available in version 1.22.1-3 of the package, we noticed the following issues:

16 patches where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2026-06-20 12:00

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.7.4 instead of 4.7.0).

Created: 2025-02-21 Last update: 2026-06-19 22:31

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-06-25] krb5 1.22.1-3 MIGRATED to testing (Debian testing watch)
[2026-06-19] Accepted krb5 1.22.1-3 (source) into unstable (Sam Hartman)
[2026-05-27] Accepted krb5 1.18.3-6+deb11u8 (source) into oldoldstable-security (Emmanuel Arias)
[2026-05-23] Accepted krb5 1.21.3-5+deb13u1 (source) into proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-05-23] Accepted krb5 1.20.1-2+deb12u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-05-23] krb5 1.22.1-2.1 MIGRATED to testing (Debian testing watch)
[2026-05-22] Accepted krb5 1.20.1-2+deb12u5 (source) into oldstable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-05-22] Accepted krb5 1.21.3-5+deb13u1 (source) into stable-security (Debian FTP Masters) (signed by: Salvatore Bonaccorso)
[2026-05-12] Accepted krb5 1.22.1-2.1 (source) into unstable (Salvatore Bonaccorso)
[2025-11-18] krb5 1.22.1-2 MIGRATED to testing (Debian testing watch)
[2025-11-14] Accepted krb5 1.22.1-2 (source) into unstable (Sam Hartman)
[2025-10-14] Accepted krb5 1.22.1-1 (source) into experimental (Sam Hartman)
[2025-05-31] Accepted krb5 1.20.1-2+deb12u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2025-05-30] Accepted krb5 1.18.3-6+deb11u7 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-04-14] Accepted krb5 1.20.1-2+deb12u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Bastien ROUCARIÈS)
[2025-03-15] krb5 1.21.3-5 MIGRATED to testing (Debian testing watch)
[2025-03-13] Accepted krb5 1.21.3-5 (source) into unstable (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-02-23] Accepted krb5 1.18.3-6+deb11u6 (source) into oldstable-security (Bastien Roucariès) (signed by: Bastien ROUCARIÈS)
[2025-01-29] krb5 1.21.3-4 MIGRATED to testing (Debian testing watch)
[2025-01-16] Accepted krb5 1.21.3-4 (source) into unstable (Sam Hartman)
[2024-07-29] krb5 1.21.3-3 MIGRATED to testing (Debian testing watch)
[2024-07-08] Accepted krb5 1.20.1-2+deb12u2 (source) into proposed-updates (Debian FTP Masters) (signed by: Sam Hartman)
[2024-07-07] Accepted krb5 1.18.3-6+deb11u5 (source) into oldstable-proposed-updates (Debian FTP Masters) (signed by: Sam Hartman)
[2024-07-05] Accepted krb5 1.18.3-6+deb11u5 (source) into oldstable-security (Debian FTP Masters) (signed by: Sam Hartman)
[2024-07-05] Accepted krb5 1.20.1-2+deb12u2 (source) into stable-security (Debian FTP Masters) (signed by: Sam Hartman)
[2024-07-05] Accepted krb5 1.21.3-3 (source) into unstable (Sam Hartman)
[2024-07-04] Accepted krb5 1.21.3-2 (source) into unstable (Sam Hartman)
[2024-06-27] Accepted krb5 1.21.3-1 (source) into unstable (Sam Hartman)
[2024-06-22] krb5 1.21.2-1 MIGRATED to testing (Debian testing watch)
[2024-06-18] Accepted krb5 1.21.2-1 (source) into unstable (Sam Hartman)

bugs [bug history graph]

all: 36 37
RC: 2
I&N: 20 21
M&W: 14
F&P: 0
patch: 4

links

homepage
lintian (0, 63)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
l10n (100, 100)
debian patches
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.22.1-3ubuntu2
27 bugs (2 patches)
patches for 1.22.1-3ubuntu2