[Bug 2132388] Re: Sync krb5 1.22.1-2 (main) from Debian unstable (main)

[Benjamin Drung]

Verified that the patches are part of the new release:

```
$ git tag --contains c5f9c816107f70139de11b38aa02db2f1774ee0d
krb5-1.22-beta1
krb5-1.22-final
krb5-1.22.1-final
$ git tag --contains 871125fea8ce0370a972bf65f7d1de63f619b06c
krb5-1.22-beta1
krb5-1.22-final
krb5-1.22.1-final
$ git tag --contains 4b9d7f7c107f01a61600fddcd8cde3812d0366a2
krb5-1.22-beta1
krb5-1.22-final
krb5-1.22.1-final
```

** Changed in: krb5 (Ubuntu)
       Status: New => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
Sponsors, which is subscribed to the bug report.
https://bugs.launchpad.net/bugs/2132388

Title:
  Sync krb5 1.22.1-2 (main) from Debian unstable (main)

Status in krb5 package in Ubuntu:
  Fix Released

Bug description:
  Please sync krb5 1.22.1-2 (main) from Debian unstable (main)

  Explanation of the Ubuntu delta and why it can be dropped:
    * Fix FTBFS with gcc-15 because of old-style function
      declarations (LP: #2123950).
    * Merge with Debian unstable (LP: #2110460). Remaining changes:
      - SECURITY UPDATE: Use of MD5-based message authentication over plaintext
        communications could lead to forgery attacks.
        + debian/patches/CVE-2024-3596.patch: Secure Response Authentication
          by adding support for the Message-Authenticator attribute in non-EAP
          authentication methods.
        + CVE-2024-3596
      - Update libk5crypto3 symbols: add k5_hmac_md5 symbol.
      - SECURITY UPDATE: denial of service via two memory leaks
        + debian/patches/CVE-2024-26458.patch: fix two unlikely memory leaks in
          src/lib/gssapi/krb5/k5sealv3.c, src/lib/rpc/pmap_rmt.c.
        + CVE-2024-26458
        + CVE-2024-26461
    * Dropped:
      - SECURITY UPDATE: kadmind DoS via iprop log file
        + debian/patches/CVE-2025-24528.patch: prevent overflow when
          calculating ulog block size in src/lib/kdb/kdb_log.c.
        + CVE-2025-24528
        [In 1.21.3-5]

  The FTBFS fix was applied in Debian 1.22.1-1 and the vulnerabilities
  were also fixed in 1.22.1-1 even though Debian didn't list them, they
  all made into upstream's version 1.22.1, therefore they can be dropped.

  Changelog entries since current resolute version 1.21.3-5ubuntu2:

  krb5 (1.22.1-2) unstable; urgency=medium

    * Release to unstable

   -- Sam Hartman <hartmans at debian.org>  Fri, 14 Nov 2025 08:18:38 -0700

  krb5 (1.22.1-1) experimental; urgency=medium

    * New upstream version
      - Builds with gcc-15, Closes: #1097099
    * Update symbols files

   -- Sam Hartman <hartmans at debian.org>  Tue, 07 Oct 2025 16:28:29 -0600

  A test build is currently being done here:
  https://launchpad.net/~ebarretto/+archive/ubuntu/devel-testing/+packages?field.name_filter=krb5&field.status_filter=published&field.series_filter=resolute

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/krb5/+bug/2132388/+subscriptions