Fix integer overflows in PAC parsing (CVE-2022-42898)

Resolves: rhbz#2143010
Signed-off-by: Julien Rische <jrische@redhat.com>

Add-configure-variable-for-default-PKCS-11-module.patch

@@ -0,0 +1,201 @@
+From 2a91dabd9752825b96faf3b25ea643d5282c5957 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 22 Apr 2022 14:12:37 +0200
+Subject: [PATCH] Add configure variable for default PKCS#11 module
+
+[ghudson@mit.edu: added documentation of configure variable and doc
+substitution; shortened commit message]
+
+ticket: 9058 (new)
+---
+ doc/admin/conf_files/krb5_conf.rst  |  2 +-
+ doc/build/options2configure.rst     |  3 +++
+ doc/conf.py                         |  3 +++
+ doc/mitK5defaults.rst               | 25 +++++++++++++------------
+ src/configure.ac                    |  8 ++++++++
+ src/doc/Makefile.in                 |  2 ++
+ src/man/Makefile.in                 |  4 +++-
+ src/man/krb5.conf.man               |  2 +-
+ src/plugins/preauth/pkinit/pkinit.h |  1 -
+ 9 files changed, 34 insertions(+), 16 deletions(-)
+
+diff --git a/doc/admin/conf_files/krb5_conf.rst b/doc/admin/conf_files/krb5_conf.rst
+index adba8238d..3d25c9a12 100644
+--- a/doc/admin/conf_files/krb5_conf.rst
++++ b/doc/admin/conf_files/krb5_conf.rst
+@@ -1020,7 +1020,7 @@ information for PKINIT is as follows:
+     All keyword/values are optional.  *modname* specifies the location
+     of a library implementing PKCS #11.  If a value is encountered
+     with no keyword, it is assumed to be the *modname*.  If no
+-    module-name is specified, the default is ``opensc-pkcs11.so``.
++    module-name is specified, the default is |pkcs11_modname|.
+     ``slotid=`` and/or ``token=`` may be specified to force the use of
+     a particular smard card reader or token if there is more than one
+     available.  ``certid=`` and/or ``certlabel=`` may be specified to
+diff --git a/doc/build/options2configure.rst b/doc/build/options2configure.rst
+index a8959626d..8f8ac911c 100644
+--- a/doc/build/options2configure.rst
++++ b/doc/build/options2configure.rst
+@@ -143,6 +143,9 @@ Environment variables
+     This option allows one to specify libraries to be passed to the
+     linker (e.g., ``-l<library>``)
+ 
++**PKCS11_MODNAME=**\ *library*
++    Override the built-in default PKCS11 library name.
++
+ **SS_LIB=**\ *libs*...
+     If ``-lss`` is not the correct way to link in your installed ss
+     library, for example if additional support libraries are needed,
+diff --git a/doc/conf.py b/doc/conf.py
+index a876fd633..252ab891a 100644
+--- a/doc/conf.py
++++ b/doc/conf.py
+@@ -242,6 +242,7 @@ if 'mansubs' in tags:
+     ccache = '``@CCNAME@``'
+     keytab = '``@KTNAME@``'
+     ckeytab = '``@CKTNAME@``'
++    pkcs11_modname = '``@PKCS11MOD@``'
+ elif 'pathsubs' in tags:
+     # Read configured paths from a file produced by the build system.
+     exec(open("paths.py").read())
+@@ -255,6 +256,7 @@ else:
+     ccache = ':ref:`DEFCCNAME <paths>`'
+     keytab = ':ref:`DEFKTNAME <paths>`'
+     ckeytab = ':ref:`DEFCKTNAME <paths>`'
++    pkcs11_modname = ':ref:`PKCS11_MODNAME <paths>`'
+ 
+ rst_epilog = '\n'
+ 
+@@ -275,6 +277,7 @@ else:
+     rst_epilog += '.. |ccache| replace:: %s\n' % ccache
+     rst_epilog += '.. |keytab| replace:: %s\n' % keytab
+     rst_epilog += '.. |ckeytab| replace:: %s\n' % ckeytab
++    rst_epilog += '.. |pkcs11_modname| replace:: %s\n' % pkcs11_modname
+     rst_epilog += '''
+ .. |krb5conf| replace:: ``/etc/krb5.conf``
+ .. |defkeysalts| replace:: ``aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal``
+diff --git a/doc/mitK5defaults.rst b/doc/mitK5defaults.rst
+index 74e69f4ad..aea7af3db 100644
+--- a/doc/mitK5defaults.rst
++++ b/doc/mitK5defaults.rst
+@@ -59,18 +59,19 @@ subdirectories of ``/usr/local``.  When MIT krb5 is integrated into an
+ operating system, the paths are generally chosen to match the
+ operating system's filesystem layout.
+ 
+-==========================  =============  ===========================  ===========================
+-Description                 Symbolic name  Custom build path            Typical OS path
+-==========================  =============  ===========================  ===========================
+-User programs               BINDIR         ``/usr/local/bin``           ``/usr/bin``
+-Libraries and plugins       LIBDIR         ``/usr/local/lib``           ``/usr/lib``
+-Parent of KDC state dir     LOCALSTATEDIR  ``/usr/local/var``           ``/var``
+-Parent of KDC runtime dir   RUNSTATEDIR    ``/usr/local/var/run``       ``/run``
+-Administrative programs     SBINDIR        ``/usr/local/sbin``          ``/usr/sbin``
+-Alternate krb5.conf dir     SYSCONFDIR     ``/usr/local/etc``           ``/etc``
+-Default ccache name         DEFCCNAME      ``FILE:/tmp/krb5cc_%{uid}``  ``FILE:/tmp/krb5cc_%{uid}``
+-Default keytab name         DEFKTNAME      ``FILE:/etc/krb5.keytab``    ``FILE:/etc/krb5.keytab``
+-==========================  =============  ===========================  ===========================
++==========================  ==============  ===========================  ===========================
++Description                 Symbolic name   Custom build path            Typical OS path
++==========================  ==============  ===========================  ===========================
++User programs               BINDIR          ``/usr/local/bin``           ``/usr/bin``
++Libraries and plugins       LIBDIR          ``/usr/local/lib``           ``/usr/lib``
++Parent of KDC state dir     LOCALSTATEDIR   ``/usr/local/var``           ``/var``
++Parent of KDC runtime dir   RUNSTATEDIR     ``/usr/local/var/run``       ``/run``
++Administrative programs     SBINDIR         ``/usr/local/sbin``          ``/usr/sbin``
++Alternate krb5.conf dir     SYSCONFDIR      ``/usr/local/etc``           ``/etc``
++Default ccache name         DEFCCNAME       ``FILE:/tmp/krb5cc_%{uid}``  ``FILE:/tmp/krb5cc_%{uid}``
++Default keytab name         DEFKTNAME       ``FILE:/etc/krb5.keytab``    ``FILE:/etc/krb5.keytab``
++Default PKCS11 module       PKCS11_MODNAME  ``opensc-pkcs11.so``         ``opensc-pkcs11.so``
++==========================  ==============  ===========================  ===========================
+ 
+ The default client keytab name (DEFCKTNAME) typically defaults to
+ ``FILE:/usr/local/var/krb5/user/%{euid}/client.keytab`` for a custom
+diff --git a/src/configure.ac b/src/configure.ac
+index 82b049af9..52e6563da 100644
+--- a/src/configure.ac
++++ b/src/configure.ac
+@@ -1442,6 +1442,14 @@ AC_DEFINE_UNQUOTED(DEFKTNAME, ["$DEFKTNAME"], [Define to default keytab name])
+ AC_DEFINE_UNQUOTED(DEFCKTNAME, ["$DEFCKTNAME"],
+                    [Define to default client keytab name])
+ 
++AC_ARG_VAR(PKCS11_MODNAME, [Default PKCS11 module name])
++if test "${PKCS11_MODNAME+set}" != set; then
++	PKCS11_MODNAME=opensc-pkcs11.so
++fi
++AC_MSG_NOTICE([Default PKCS11 module name: $PKCS11_MODNAME])
++AC_DEFINE_UNQUOTED(PKCS11_MODNAME, ["$PKCS11_MODNAME"],
++                   [Default PKCS11 module name])
++
+ AC_CONFIG_FILES([build-tools/krb5-config], [chmod +x build-tools/krb5-config])
+ AC_CONFIG_FILES([build-tools/kadm-server.pc
+ 	build-tools/kadm-client.pc
+diff --git a/src/doc/Makefile.in b/src/doc/Makefile.in
+index 379bc3651..a1b0cff0a 100644
+--- a/src/doc/Makefile.in
++++ b/src/doc/Makefile.in
+@@ -10,6 +10,7 @@ sysconfdir=@sysconfdir@
+ DEFCCNAME=@DEFCCNAME@
+ DEFKTNAME=@DEFKTNAME@
+ DEFCKTNAME=@DEFCKTNAME@
++PKCS11_MODNAME=@PKCS11_MODNAME@
+ 
+ RST_SOURCES= _static \
+ 	_templates \
+@@ -118,6 +119,7 @@ paths.py:
+ 	echo 'ccache = "``$(DEFCCNAME)``"' >> $@
+ 	echo 'keytab = "``$(DEFKTNAME)``"' >> $@
+ 	echo 'ckeytab = "``$(DEFCKTNAME)``"' >> $@
++	echo 'pkcs11_modname = "``$(PKCS11_MODNAME)``"' >> $@
+ 
+ # Dummy rule that man/Makefile can invoke
+ version.py: $(docsrc)/version.py
+diff --git a/src/man/Makefile.in b/src/man/Makefile.in
+index 00b1b2de0..85cae0914 100644
+--- a/src/man/Makefile.in
++++ b/src/man/Makefile.in
+@@ -8,6 +8,7 @@ sysconfdir=@sysconfdir@
+ DEFCCNAME=@DEFCCNAME@
+ DEFKTNAME=@DEFKTNAME@
+ DEFCKTNAME=@DEFCKTNAME@
++PKCS11_MODNAME=@PKCS11_MODNAME@
+ 
+ MANSUBS=k5identity.sub k5login.sub k5srvutil.sub kadm5.acl.sub kadmin.sub \
+ 	kadmind.sub kdb5_ldap_util.sub kdb5_util.sub kdc.conf.sub \
+@@ -47,7 +48,8 @@ $(docsrc)/version.py: $(top_srcdir)/patchlevel.h
+ 	    -e 's|@SYSCONFDIR@|$(sysconfdir)|g' \
+ 	    -e 's|@CCNAME@|$(DEFCCNAME)|g' \
+ 	    -e 's|@KTNAME@|$(DEFKTNAME)|g' \
+-	    -e 's|@CKTNAME@|$(DEFCKTNAME)|g' $? > $@
++	    -e 's|@CKTNAME@|$(DEFCKTNAME)|g' \
++	    -e 's|@PKCS11MOD@|$(PKCS11_MODNAME)|g' $? > $@
+ 
+ all: $(MANSUBS)
+ 
+diff --git a/src/man/krb5.conf.man b/src/man/krb5.conf.man
+index e993d5c09..42f5ea4f9 100644
+--- a/src/man/krb5.conf.man
++++ b/src/man/krb5.conf.man
+@@ -1151,7 +1151,7 @@ user\(aqs certificate and private key.
+ All keyword/values are optional.  \fImodname\fP specifies the location
+ of a library implementing PKCS #11.  If a value is encountered
+ with no keyword, it is assumed to be the \fImodname\fP\&.  If no
+-module\-name is specified, the default is \fBopensc\-pkcs11.so\fP\&.
++module\-name is specified, the default is \fB@PKCS11MOD@\fP\&.
+ \fBslotid=\fP and/or \fBtoken=\fP may be specified to force the use of
+ a particular smard card reader or token if there is more than one
+ available.  \fBcertid=\fP and/or \fBcertlabel=\fP may be specified to
+diff --git a/src/plugins/preauth/pkinit/pkinit.h b/src/plugins/preauth/pkinit/pkinit.h
+index b437fd53f..a2018cb10 100644
+--- a/src/plugins/preauth/pkinit/pkinit.h
++++ b/src/plugins/preauth/pkinit/pkinit.h
+@@ -42,7 +42,6 @@
+ #ifndef WITHOUT_PKCS11
+ #include "pkcs11.h"
+ 
+-#define PKCS11_MODNAME "opensc-pkcs11.so"
+ #define PK_SIGLEN_GUESS 1000
+ #define PK_NOSLOT 999999
+ #endif
+-- 
+2.35.1
+

Fix-integer-overflows-in-PAC-parsing.patch

@@ -0,0 +1,106 @@
+From c0f643a96272d11ae1255bc361f24133d1e58b74 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Mon, 17 Oct 2022 20:25:11 -0400
+Subject: [PATCH] Fix integer overflows in PAC parsing
+
+In krb5_parse_pac(), check for buffer counts large enough to threaten
+integer overflow in the header length and memory length calculations.
+Avoid potential integer overflows when checking the length of each
+buffer.
+
+CVE-2022-42898:
+
+In MIT krb5 releases 1.8 and later, an authenticated attacker may be
+able to cause a KDC or kadmind process to crash by reading beyond the
+bounds of allocated memory, creating a denial of service.  A
+privileged attacker may similarly be able to cause a Kerberos or GSS
+application service to crash.  On 32-bit platforms, an attacker can
+also cause insufficient memory to be allocated for the result,
+potentially leading to remote code execution in a KDC, kadmind, or GSS
+or Kerberos application server process.  An attacker with the
+privileges of a cross-realm KDC may be able to extract secrets from
+the KDC process's memory by having them copied into the PAC of a new
+ticket.
+
+ticket: 9074 (new)
+tags: pullup
+target_version: 1.20-next
+target_version: 1.19-next
+---
+ src/lib/krb5/krb/pac.c   |  9 +++++++--
+ src/lib/krb5/krb/t_pac.c | 18 ++++++++++++++++++
+ 2 files changed, 25 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/krb5/krb/pac.c b/src/lib/krb5/krb/pac.c
+index 950beda657..1b9ef12276 100644
+--- a/src/lib/krb5/krb/pac.c
++++ b/src/lib/krb5/krb/pac.c
+@@ -27,6 +27,8 @@
+ #include "k5-int.h"
+ #include "authdata.h"
+ 
++#define MAX_BUFFERS 4096
++
+ /* draft-brezak-win2k-krb-authz-00 */
+ 
+ /*
+@@ -316,6 +318,9 @@ krb5_pac_parse(krb5_context context,
+     if (version != 0)
+         return EINVAL;
+ 
++    if (cbuffers < 1 || cbuffers > MAX_BUFFERS)
++        return ERANGE;
++
+     header_len = PACTYPE_LENGTH + (cbuffers * PAC_INFO_BUFFER_LENGTH);
+     if (len < header_len)
+         return ERANGE;
+@@ -348,8 +353,8 @@ krb5_pac_parse(krb5_context context,
+             krb5_pac_free(context, pac);
+             return EINVAL;
+         }
+-        if (buffer->Offset < header_len ||
+-            buffer->Offset + buffer->cbBufferSize > len) {
++        if (buffer->Offset < header_len || buffer->Offset > len ||
++            buffer->cbBufferSize > len - buffer->Offset) {
+             krb5_pac_free(context, pac);
+             return ERANGE;
+         }
+diff --git a/src/lib/krb5/krb/t_pac.c b/src/lib/krb5/krb/t_pac.c
+index ee47152ee4..ccd165380d 100644
+--- a/src/lib/krb5/krb/t_pac.c
++++ b/src/lib/krb5/krb/t_pac.c
+@@ -431,6 +431,16 @@ static const unsigned char s4u_pac_ent_xrealm[] = {
+     0x8a, 0x81, 0x9c, 0x9c, 0x00, 0x00, 0x00, 0x00
+ };
+ 
++static const unsigned char fuzz1[] = {
++    0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00,
++    0x06, 0xff, 0xff, 0xff, 0x00, 0x00, 0xf5
++};
++
++static const unsigned char fuzz2[] = {
++    0x00, 0x00, 0x00, 0x20, 0x00, 0x00, 0x00, 0x00,
++    0x20, 0x20
++};
++
+ static const char *s4u_principal = "w2k8u@ACME.COM";
+ static const char *s4u_enterprise = "w2k8u@abc@ACME.COM";
+ 
+@@ -646,6 +656,14 @@ main(int argc, char **argv)
+         krb5_free_principal(context, sep);
+     }
+ 
++    /* Check problematic PACs found by fuzzing. */
++    ret = krb5_pac_parse(context, fuzz1, sizeof(fuzz1), &pac);
++    if (!ret)
++        err(context, ret, "krb5_pac_parse should have failed");
++    ret = krb5_pac_parse(context, fuzz2, sizeof(fuzz2), &pac);
++    if (!ret)
++        err(context, ret, "krb5_pac_parse should have failed");
++
+     /*
+      * Test empty free
+      */
+-- 
+2.37.3
+

Read-GSS-configuration-files-with-mtime-0.patch

@@ -0,0 +1,71 @@
+From f8747c22fd159ad3556fdf6ec4f269c754c1eadb Mon Sep 17 00:00:00 2001
+From: Simo Sorce <simo@redhat.com>
+Date: Thu, 19 May 2022 12:27:40 -0400
+Subject: [PATCH] Read GSS configuration files with mtime 0
+
+There is at least one case (with flatpaks) where configuration files
+in the special read-only /etc all have an mtime of 0.  Using an
+initial last modified time of 0 in g_initialize.c causes these files
+to never be read.
+
+Change the initial high value to the be the "invalid" value
+(time_t)-1.  Since the C and POSIX standards do not require time_t to
+be signed, special-case the checks in load_if_changed() and
+updateMechList() to treat all mod times as newer than -1.
+
+[ghudson@mit.edu: edited commit message; slightly modified approach]
+
+ticket: 9060 (new)
+target_version: 1.20
+tags: pullup
+---
+ src/lib/gssapi/mechglue/g_initialize.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/src/lib/gssapi/mechglue/g_initialize.c b/src/lib/gssapi/mechglue/g_initialize.c
+index 6d49700a5..857d4a4f2 100644
+--- a/src/lib/gssapi/mechglue/g_initialize.c
++++ b/src/lib/gssapi/mechglue/g_initialize.c
+@@ -93,7 +93,7 @@ static void free_mechSet(void);
+ static gss_mech_info g_mechList = NULL;
+ static gss_mech_info g_mechListTail = NULL;
+ static k5_mutex_t g_mechListLock = K5_MUTEX_PARTIAL_INITIALIZER;
+-static time_t g_confFileModTime = (time_t)0;
++static time_t g_confFileModTime = (time_t)-1;
+ static time_t g_confLastCall = (time_t)0;
+ 
+ static gss_OID_set_desc g_mechSet = { 0, NULL };
+@@ -469,9 +469,9 @@ load_if_changed(const char *pathname, time_t last, time_t *highest)
+ 	mtime = check_link_mtime(pathname, &mtime);
+ 	if (mtime == (time_t)-1)
+ 		return;
+-	if (mtime > *highest)
++	if (mtime > *highest || *highest == (time_t)-1)
+ 		*highest = mtime;
+-	if (mtime > last)
++	if (mtime > last || last == (time_t)-1)
+ 		loadConfigFile(pathname);
+ }
+ 
+@@ -482,7 +482,7 @@ static void
+ loadConfigFiles()
+ {
+ 	glob_t globbuf;
+-	time_t highest = 0, now;
++	time_t highest = (time_t)-1, now;
+ 	char **path;
+ 	const char *val;
+ 
+@@ -522,7 +522,8 @@ updateMechList(void)
+ 
+ #if defined(_WIN32)
+ 	time_t lastConfModTime = getRegConfigModTime(MECH_KEY);
+-	if (g_confFileModTime >= lastConfModTime)
++	if (g_confFileModTime >= lastConfModTime &&
++	    g_confFileModTime != (time_t)-1)
+ 		return;
+ 	g_confFileModTime = lastConfModTime;
+ 	loadConfigFromRegistry(HKEY_CURRENT_USER, MECH_KEY);
+-- 
+2.35.3
+

Try-harder-to-avoid-password-change-replay-errors.patch

@@ -0,0 +1,91 @@
+From f214136115e2e8724866de258021e93554034678 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Fri, 4 Mar 2022 00:45:00 -0500
+Subject: [PATCH] Try harder to avoid password change replay errors
+
+Commit d7b3018d338fc9c989c3fa17505870f23c3759a8 (ticket 7905) changed
+change_set_password() to prefer TCP.  However, because UDP_LAST falls
+back to UDP after one second, we can still get a replay error due to a
+dropped packet, before the TCP layer has a chance to retry.
+
+Instead, try k5_sendto() with NO_UDP, and only fall back to UDP after
+TCP fails completely without reaching a server.  In sendto_kdc.c,
+implement an ONLY_UDP transport strategy to allow the UDP fallback.
+
+ticket: 9037
+---
+ src/lib/krb5/os/changepw.c   |  9 ++++++++-
+ src/lib/krb5/os/os-proto.h   |  1 +
+ src/lib/krb5/os/sendto_kdc.c | 12 ++++++++----
+ 3 files changed, 17 insertions(+), 5 deletions(-)
+
+diff --git a/src/lib/krb5/os/changepw.c b/src/lib/krb5/os/changepw.c
+index 9f968da7f..c59232586 100644
+--- a/src/lib/krb5/os/changepw.c
++++ b/src/lib/krb5/os/changepw.c
+@@ -255,9 +255,16 @@ change_set_password(krb5_context context,
+     callback_info.pfn_cleanup = kpasswd_sendto_msg_cleanup;
+     krb5_free_data_contents(callback_ctx.context, &chpw_rep);
+ 
++    /* UDP retransmits may be seen as replays.  Only try UDP after other
++     * transports fail completely. */
+     code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm,
+-                     &sl, UDP_LAST, &callback_info, &chpw_rep,
++                     &sl, NO_UDP, &callback_info, &chpw_rep,
+                      ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL);
++    if (code == KRB5_KDC_UNREACH) {
++        code = k5_sendto(callback_ctx.context, NULL, &creds->server->realm,
++                         &sl, ONLY_UDP, &callback_info, &chpw_rep,
++                         ss2sa(&remote_addr), &addrlen, NULL, NULL, NULL);
++    }
+     if (code)
+         goto cleanup;
+ 
+diff --git a/src/lib/krb5/os/os-proto.h b/src/lib/krb5/os/os-proto.h
+index a985f2aec..91d2791ce 100644
+--- a/src/lib/krb5/os/os-proto.h
++++ b/src/lib/krb5/os/os-proto.h
+@@ -49,6 +49,7 @@ typedef enum {
+     UDP_FIRST = 0,
+     UDP_LAST,
+     NO_UDP,
++    ONLY_UDP
+ } k5_transport_strategy;
+ 
+ /* A single server hostname or address. */
+diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c
+index 0eedec175..c7f5d861a 100644
+--- a/src/lib/krb5/os/sendto_kdc.c
++++ b/src/lib/krb5/os/sendto_kdc.c
+@@ -802,11 +802,14 @@ resolve_server(krb5_context context, const krb5_data *realm,
+     int err, result;
+     char portbuf[PORT_LENGTH];
+ 
+-    /* Skip UDP entries if we don't want UDP. */
++    /* Skip entries excluded by the strategy. */
+     if (strategy == NO_UDP && entry->transport == UDP)
+         return 0;
++    if (strategy == ONLY_UDP && entry->transport != UDP &&
++        entry->transport != TCP_OR_UDP)
++        return 0;
+ 
+-    transport = (strategy == UDP_FIRST) ? UDP : TCP;
++    transport = (strategy == UDP_FIRST || strategy == ONLY_UDP) ? UDP : TCP;
+     if (entry->hostname == NULL) {
+         /* Added by a module, so transport is either TCP or UDP. */
+         ai.ai_socktype = socktype_for_transport(entry->transport);
+@@ -850,8 +853,9 @@ resolve_server(krb5_context context, const krb5_data *realm,
+     }
+ 
+     /* For TCP_OR_UDP entries, add each address again with the non-preferred
+-     * transport, unless we are avoiding UDP.  Flag these as deferred. */
+-    if (retval == 0 && entry->transport == TCP_OR_UDP && strategy != NO_UDP) {
++     * transport, if there is one.  Flag these as deferred. */
++    if (retval == 0 && entry->transport == TCP_OR_UDP &&
++        (strategy == UDP_FIRST || strategy == UDP_LAST)) {
+         transport = (strategy == UDP_FIRST) ? TCP : UDP;
+         for (a = addrs; a != 0 && retval == 0; a = a->ai_next) {
+             a->ai_socktype = socktype_for_transport(transport);
+-- 
+2.35.1
+

Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch

@@ -0,0 +1,113 @@
+From 73daa015af24476bb7cf7e36a7b16d7197c81acd Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Fri, 11 Mar 2022 11:33:56 +0100
+Subject: [PATCH] Use SHA-256 instead of SHA-1 for PKINIT CMS digest
+
+Various organizations including NIST have been strongly recommending to
+stop using SHA-1 for digital signatures for some years already. CMS
+digest is used to generate such signatures, hence it should be upgraded
+to use SHA-256.
+---
+ .../preauth/pkinit/pkinit_crypto_openssl.c    | 27 ++++++++++---------
+ 1 file changed, 14 insertions(+), 13 deletions(-)
+
+diff --git a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+index 42e5c581d..2a6ef4aaa 100644
+--- a/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
++++ b/src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
+@@ -1240,7 +1240,7 @@ cms_signeddata_create(krb5_context context,
+         /* will not fill-out EVP_PKEY because it's on the smartcard */
+ 
+         /* Set digest algs */
+-        p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha1);
++        p7si->digest_alg->algorithm = OBJ_nid2obj(NID_sha256);
+ 
+         if (p7si->digest_alg->parameter != NULL)
+             ASN1_TYPE_free(p7si->digest_alg->parameter);
+@@ -1251,17 +1251,17 @@ cms_signeddata_create(krb5_context context,
+         /* Set sig algs */
+         if (p7si->digest_enc_alg->parameter != NULL)
+             ASN1_TYPE_free(p7si->digest_enc_alg->parameter);
+-        p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha1WithRSAEncryption);
++        p7si->digest_enc_alg->algorithm = OBJ_nid2obj(NID_sha256WithRSAEncryption);
+         if (!(p7si->digest_enc_alg->parameter = ASN1_TYPE_new()))
+             goto cleanup;
+         p7si->digest_enc_alg->parameter->type = V_ASN1_NULL;
+ 
+         /* add signed attributes */
+-        /* compute sha1 digest over the EncapsulatedContentInfo */
++        /* compute sha256 digest over the EncapsulatedContentInfo */
+         ctx = EVP_MD_CTX_new();
+         if (ctx == NULL)
+             goto cleanup;
+-        EVP_DigestInit_ex(ctx, EVP_sha1(), NULL);
++        EVP_DigestInit_ex(ctx, EVP_sha256(), NULL);
+         EVP_DigestUpdate(ctx, data, data_len);
+         md_tmp = EVP_MD_CTX_md(ctx);
+         EVP_DigestFinal_ex(ctx, md_data, &md_len);
+@@ -1289,9 +1289,10 @@ cms_signeddata_create(krb5_context context,
+             goto cleanup2;
+ 
+ #ifndef WITHOUT_PKCS11
+-        /* Some tokens can only do RSAEncryption without sha1 hash */
+-        /* to compute sha1WithRSAEncryption, encode the algorithm ID for the hash
+-         * function and the hash value into an ASN.1 value of type DigestInfo
++        /* Some tokens can only do RSAEncryption without sha256 hash */
++        /* to compute sha256WithRSAEncryption, encode the algorithm ID for the
++         * hash function and the hash value into an ASN.1 value of type
++         * DigestInfo
+          * DigestInfo::=SEQUENCE {
+          *  digestAlgorithm  AlgorithmIdentifier,
+          *  digest OCTET STRING }
+@@ -1310,7 +1311,7 @@ cms_signeddata_create(krb5_context context,
+             alg = X509_ALGOR_new();
+             if (alg == NULL)
+                 goto cleanup2;
+-            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha1), V_ASN1_NULL, NULL);
++            X509_ALGOR_set0(alg, OBJ_nid2obj(NID_sha256), V_ASN1_NULL, NULL);
+             alg_len = i2d_X509_ALGOR(alg, NULL);
+ 
+             digest = ASN1_OCTET_STRING_new();
+@@ -1339,7 +1340,7 @@ cms_signeddata_create(krb5_context context,
+ #endif
+         {
+             pkiDebug("mech = %s\n",
+-                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA1_RSA_PKCS" : "FS");
++                     id_cryptoctx->pkcs11_method == 1 ? "CKM_SHA256_RSA_PKCS" : "FS");
+             retval = pkinit_sign_data(context, id_cryptoctx, abuf, alen,
+                                       &sig, &sig_len);
+         }
+@@ -4189,7 +4190,7 @@ create_signature(unsigned char **sig, unsigned int *sig_len,
+     ctx = EVP_MD_CTX_new();
+     if (ctx == NULL)
+         return ENOMEM;
+-    EVP_SignInit(ctx, EVP_sha1());
++    EVP_SignInit(ctx, EVP_sha256());
+     EVP_SignUpdate(ctx, data, data_len);
+     *sig_len = EVP_PKEY_size(pkey);
+     if ((*sig = malloc(*sig_len)) == NULL)
+@@ -4663,10 +4664,10 @@ pkinit_get_certs_pkcs11(krb5_context context,
+ 
+ #ifndef PKINIT_USE_MECH_LIST
+     /*
+-     * We'd like to use CKM_SHA1_RSA_PKCS for signing if it's available, but
++     * We'd like to use CKM_SHA256_RSA_PKCS for signing if it's available, but
+      * many cards seems to be confused about whether they are capable of
+      * this or not. The safe thing seems to be to ignore the mechanism list,
+-     * always use CKM_RSA_PKCS and calculate the sha1 digest ourselves.
++     * always use CKM_RSA_PKCS and calculate the sha256 digest ourselves.
+      */
+ 
+     id_cryptoctx->mech = CKM_RSA_PKCS;
+@@ -4694,7 +4695,7 @@ pkinit_get_certs_pkcs11(krb5_context context,
+         if (mechp[i] == CKM_RSA_PKCS) {
+             /* This seems backwards... */
+             id_cryptoctx->mech =
+-                (info.flags & CKF_SIGN) ? CKM_SHA1_RSA_PKCS : CKM_RSA_PKCS;
++                (info.flags & CKF_SIGN) ? CKM_SHA256_RSA_PKCS : CKM_RSA_PKCS;
+         }
+     }
+     free(mechp);
+-- 
+2.35.1
+

downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch

@@ -0,0 +1,81 @@
+From a43d621ae83c89abb74764f0fd9d90a8e9992333 Mon Sep 17 00:00:00 2001
+From: Julien Rische <jrische@redhat.com>
+Date: Thu, 5 May 2022 17:15:12 +0200
+Subject: [PATCH] Allow krad UDP/TCP localhost connection with FIPS
+
+libkrad allows to establish connections only to UNIX socket in FIPS
+mode, because MD5 digest is not considered safe enough to be used for
+network communication. However, FreeRadius requires connection on TCP or
+UDP ports.
+
+This commit allows TCP or UDP connections in FIPS mode if destination is
+localhost.
+
+Resolves: rhbz#2082189
+---
+ src/lib/krad/remote.c | 35 +++++++++++++++++++++++++++++++++--
+ 1 file changed, 33 insertions(+), 2 deletions(-)
+
+diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
+index 7b5804b1d..e671bc5c2 100644
+--- a/src/lib/krad/remote.c
++++ b/src/lib/krad/remote.c
+@@ -33,6 +33,7 @@
+ 
+ #include <string.h>
+ #include <unistd.h>
++#include <stdbool.h>
+ 
+ #include <sys/un.h>
+ 
+@@ -74,6 +75,35 @@ on_io(verto_ctx *ctx, verto_ev *ev);
+ static void
+ on_timeout(verto_ctx *ctx, verto_ev *ev);
+ 
++static in_addr_t get_in_addr(struct addrinfo *info)
++{ return ((struct sockaddr_in *)(info->ai_addr))->sin_addr.s_addr; }
++
++static struct in6_addr *get_in6_addr(struct addrinfo *info)
++{ return &(((struct sockaddr_in6 *)(info->ai_addr))->sin6_addr); }
++
++static bool is_inet_localhost(struct addrinfo *info)
++{
++    struct addrinfo *p;
++
++    for (p = info; p; p = p->ai_next) {
++        switch (p->ai_family) {
++            case AF_INET:
++                if (IN_LOOPBACKNET != (get_in_addr(p) & IN_CLASSA_NET
++                                                      >> IN_CLASSA_NSHIFT))
++                    return false;
++                break;
++            case AF_INET6:
++                if (!IN6_IS_ADDR_LOOPBACK(get_in6_addr(p)))
++                    return false;
++                break;
++            default:
++                return false;
++        }
++    }
++
++    return true;
++}
++
+ /* Iterate over the set of outstanding packets. */
+ static const krad_packet *
+ iterator(request **out)
+@@ -455,8 +485,9 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
+                                      (krad_packet_iter_cb)iterator, &r, &tmp);
+     if (retval != 0)
+         goto error;
+-    else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL &&
+-        rr->info->ai_family != AF_UNIX) {
++    else if (tmp->is_fips && rr->info->ai_family != AF_LOCAL
++                          && rr->info->ai_family != AF_UNIX
++                          && !is_inet_localhost(rr->info)) {
+         /* This would expose cleartext passwords, so abort. */
+         retval = ESOCKTNOSUPPORT;
+         goto error;
+-- 
+2.35.1
+

krb5-krad-larger-attrs.patch

@@ -0,0 +1,69 @@
+From f35077bfc570205092eca2a9d44e50ce265622f4 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Mon, 8 Nov 2021 17:48:50 +0100
+Subject: [PATCH] Support larger RADIUS attributes in libkrad
+
+In kr_attrset_decode(), explicitly treat the length byte as unsigned.
+Otherwise attributes longer than 125 characters will be rejected with
+EBADMSG.
+
+Add a 253-character-long NAS-Identifier attribute to the tests to make
+sure that attributes with the maximal number of characters are working
+as expected.
+
+[ghudson@mit.edu: used uint8_t cast per current practices; edited
+commit message]
+
+ticket: 9036 (new)
+---
+ src/lib/krad/attrset.c  |  2 +-
+ src/lib/krad/t_packet.c | 13 +++++++++++++
+ 2 files changed, 14 insertions(+), 1 deletion(-)
+
+diff --git a/src/lib/krad/attrset.c b/src/lib/krad/attrset.c
+index 03c613716..f309f1581 100644
+--- a/src/lib/krad/attrset.c
++++ b/src/lib/krad/attrset.c
+@@ -217,7 +217,7 @@ kr_attrset_decode(krb5_context ctx, const krb5_data *in, const char *secret,
+ 
+     for (i = 0; i + 2 < in->length; ) {
+         type = in->data[i++];
+-        tmp = make_data(&in->data[i + 1], in->data[i] - 2);
++        tmp = make_data(&in->data[i + 1], (uint8_t)in->data[i] - 2);
+         i += tmp.length + 1;
+ 
+         retval = (in->length < i) ? EBADMSG : 0;
+diff --git a/src/lib/krad/t_packet.c b/src/lib/krad/t_packet.c
+index 0a92e9cc2..c22489144 100644
+--- a/src/lib/krad/t_packet.c
++++ b/src/lib/krad/t_packet.c
+@@ -57,6 +57,14 @@ make_packet(krb5_context ctx, const krb5_data *username,
+     krb5_error_code retval;
+     const krb5_data *data;
+     int i = 0;
++    krb5_data nas_id;
++
++    nas_id = string2data("12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "12345678901234567890123456789012345678901234567890"
++                         "123");
+ 
+     retval = krad_attrset_new(ctx, &set);
+     if (retval != 0)
+@@ -71,6 +79,11 @@ make_packet(krb5_context ctx, const krb5_data *username,
+     if (retval != 0)
+         goto out;
+ 
++    retval = krad_attrset_add(set, krad_attr_name2num("NAS-Identifier"),
++                              &nas_id);
++    if (retval != 0)
++        goto out;
++
+     retval = krad_packet_new_request(ctx, "foo",
+                                      krad_code_name2num("Access-Request"),
+                                      set, iterator, &i, &tmp);
+-- 
+2.35.1
+

krb5-krad-remote.patch

@@ -0,0 +1,209 @@
+From ce160f8826bae223876a6527a731c36b6912db15 Mon Sep 17 00:00:00 2001
+From: Greg Hudson <ghudson@mit.edu>
+Date: Tue, 9 Nov 2021 13:00:43 -0500
+Subject: [PATCH 1/2] Avoid use after free during libkrad cleanup
+
+libkrad client requests contain a list of references to remotes, with
+no back-references or reference counts.  To prevent accesses to
+dangling references during cleanup, cancel all requests on all remotes
+before freeing any remotes.
+
+Remove the code for aging out unused servers.  This code was fairly
+safe as all requests referencing a remote should have completed or
+timed out during an hour of disuse, but in the current design we have
+no way to guarantee or check that.  The set of addresses we send
+RADIUS requests to will generally be small, so aging out servers is
+unnecessary.
+
+ticket: 9035 (new)
+---
+ src/lib/krad/client.c   | 42 ++++++++++++++---------------------------
+ src/lib/krad/internal.h |  4 ++++
+ src/lib/krad/remote.c   | 11 ++++++++---
+ 3 files changed, 26 insertions(+), 31 deletions(-)
+
+diff --git a/src/lib/krad/client.c b/src/lib/krad/client.c
+index 6365dd1c6..810940afc 100644
+--- a/src/lib/krad/client.c
++++ b/src/lib/krad/client.c
+@@ -64,7 +64,6 @@ struct request_st {
+ 
+ struct server_st {
+     krad_remote *serv;
+-    time_t last;
+     K5_LIST_ENTRY(server_st) list;
+ };
+ 
+@@ -81,15 +80,10 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret,
+            krad_remote **out)
+ {
+     krb5_error_code retval;
+-    time_t currtime;
+     server *srv;
+ 
+-    if (time(&currtime) == (time_t)-1)
+-        return errno;
+-
+     K5_LIST_FOREACH(srv, &rc->servers, list) {
+         if (kr_remote_equals(srv->serv, ai, secret)) {
+-            srv->last = currtime;
+             *out = srv->serv;
+             return 0;
+         }
+@@ -98,7 +92,6 @@ get_server(krad_client *rc, const struct addrinfo *ai, const char *secret,
+     srv = calloc(1, sizeof(server));
+     if (srv == NULL)
+         return ENOMEM;
+-    srv->last = currtime;
+ 
+     retval = kr_remote_new(rc->kctx, rc->vctx, ai, secret, &srv->serv);
+     if (retval != 0) {
+@@ -173,28 +166,12 @@ request_new(krad_client *rc, krad_code code, const krad_attrset *attrs,
+     return 0;
+ }
+ 
+-/* Close remotes that haven't been used in a while. */
+-static void
+-age(struct server_head *head, time_t currtime)
+-{
+-    server *srv, *tmp;
+-
+-    K5_LIST_FOREACH_SAFE(srv, head, list, tmp) {
+-        if (currtime == (time_t)-1 || currtime - srv->last > 60 * 60) {
+-            K5_LIST_REMOVE(srv, list);
+-            kr_remote_free(srv->serv);
+-            free(srv);
+-        }
+-    }
+-}
+-
+ /* Handle a response from a server (or related errors). */
+ static void
+ on_response(krb5_error_code retval, const krad_packet *reqp,
+             const krad_packet *rspp, void *data)
+ {
+     request *req = data;
+-    time_t currtime;
+     size_t i;
+ 
+     /* Do nothing if we are already completed. */
+@@ -221,10 +198,6 @@ on_response(krb5_error_code retval, const krad_packet *reqp,
+     for (i = 0; req->remotes[i].remote != NULL; i++)
+         kr_remote_cancel(req->remotes[i].remote, req->remotes[i].packet);
+ 
+-    /* Age out servers that haven't been used in a while. */
+-    if (time(&currtime) != (time_t)-1)
+-        age(&req->rc->servers, currtime);
+-
+     request_free(req);
+ }
+ 
+@@ -247,10 +220,23 @@ krad_client_new(krb5_context kctx, verto_ctx *vctx, krad_client **out)
+ void
+ krad_client_free(krad_client *rc)
+ {
++    server *srv;
++
+     if (rc == NULL)
+         return;
+ 
+-    age(&rc->servers, -1);
++    /* Cancel all requests before freeing any remotes, since each request's
++     * callback data may contain references to multiple remotes. */
++    K5_LIST_FOREACH(srv, &rc->servers, list)
++        kr_remote_cancel_all(srv->serv);
++
++    while (!K5_LIST_EMPTY(&rc->servers)) {
++        srv = K5_LIST_FIRST(&rc->servers);
++        K5_LIST_REMOVE(srv, list);
++        kr_remote_free(srv->serv);
++        free(srv);
++    }
++
+     free(rc);
+ }
+ 
+diff --git a/src/lib/krad/internal.h b/src/lib/krad/internal.h
+index 0143d155a..7619563fc 100644
+--- a/src/lib/krad/internal.h
++++ b/src/lib/krad/internal.h
+@@ -109,6 +109,10 @@ kr_remote_send(krad_remote *rr, krad_code code, krad_attrset *attrs,
+ void
+ kr_remote_cancel(krad_remote *rr, const krad_packet *pkt);
+ 
++/* Cancel all requests awaiting responses. */
++void
++kr_remote_cancel_all(krad_remote *rr);
++
+ /* Determine if this remote object refers to the remote resource identified
+  * by the addrinfo struct and the secret. */
+ krb5_boolean
+diff --git a/src/lib/krad/remote.c b/src/lib/krad/remote.c
+index 7e491e994..06ae751bc 100644
+--- a/src/lib/krad/remote.c
++++ b/src/lib/krad/remote.c
+@@ -421,15 +421,20 @@ error:
+     return retval;
+ }
+ 
++void
++kr_remote_cancel_all(krad_remote *rr)
++{
++    while (!K5_TAILQ_EMPTY(&rr->list))
++        request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL);
++}
++
+ void
+ kr_remote_free(krad_remote *rr)
+ {
+     if (rr == NULL)
+         return;
+ 
+-    while (!K5_TAILQ_EMPTY(&rr->list))
+-        request_finish(K5_TAILQ_FIRST(&rr->list), ECANCELED, NULL);
+-
++    kr_remote_cancel_all(rr);
+     free(rr->secret);
+     if (rr->info != NULL)
+         free(rr->info->ai_addr);
+-- 
+2.35.1
+
+
+From e0084425df784952e76b3bcc8ae9d08300234733 Mon Sep 17 00:00:00 2001
+From: Sumit Bose <sbose@redhat.com>
+Date: Mon, 8 Nov 2021 17:47:17 +0100
+Subject: [PATCH 2/2] More python3 fixes for t_daemon.py
+
+[ghudson@mit.edu: use a list comprehension instead of map()]
+---
+ src/lib/krad/t_daemon.py | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+diff --git a/src/lib/krad/t_daemon.py b/src/lib/krad/t_daemon.py
+index 7668cd7f8..4a3de079c 100755
+--- a/src/lib/krad/t_daemon.py
++++ b/src/lib/krad/t_daemon.py
+@@ -50,7 +50,7 @@ class TestServer(server.Server):
+ 
+         for key in pkt.keys():
+             if key == "User-Password":
+-                passwd = map(pkt.PwDecrypt, pkt[key])
++                passwd = [pkt.PwDecrypt(x) for x in pkt[key]]
+ 
+         reply = self.CreateReplyPacket(pkt)
+         if passwd == ['accept']:
+@@ -61,8 +61,8 @@ class TestServer(server.Server):
+ 
+ srv = TestServer(addresses=["localhost"],
+                  hosts={"127.0.0.1":
+-                        server.RemoteHost("127.0.0.1", "foo", "localhost")},
+-                 dict=dictionary.Dictionary(StringIO.StringIO(DICTIONARY)))
++                        server.RemoteHost("127.0.0.1", b"foo", "localhost")},
++                 dict=dictionary.Dictionary(StringIO(DICTIONARY)))
+ 
+ # Write a sentinel character to let the parent process know we're listening.
+ sys.stdout.write("~")
+-- 
+2.35.1
+

krb5.spec

@@ -1,8 +1,3 @@
-# Force to not include the package note file
-# the non-existing package note file is pulled into krb5-config
-# and breaks any application that is using krb5 development libs
-%undefine _package_note_file
-
 %bcond_without check
 %if %{without check}
 %global skipcheck 1
@@ -47,7 +42,7 @@
 Summary: The Kerberos network authentication system
 Name: krb5
 Version: 1.19.2
-Release: %{?zdpd}5%{?dist}
+Release: %{?zdpd}12%{?dist}
 
 # rharwood has trust path to signing key and verifies on check-in
 Source0: https://web.mit.edu/kerberos/dist/krb5/%{version}/krb5-%{version}%{?dashpre}.tar.gz
@@ -99,6 +94,14 @@ Patch33: Use-OpenSSL-s-SSKDF-in-PKINIT-when-available.patch
 Patch34: Use-OpenSSL-s-KBKDF-and-KRB5KDF-for-deriving-long-te.patch
 Patch35: Handle-OpenSSL-3-s-providers.patch
 Patch36: Remove-TCL-based-libkadm5-API-tests.patch
+Patch37: Use-SHA256-instead-of-SHA1-for-PKINIT-CMS-digest.patch
+Patch38: krb5-krad-remote.patch
+Patch39: krb5-krad-larger-attrs.patch
+Patch40: Try-harder-to-avoid-password-change-replay-errors.patch
+Patch41: Add-configure-variable-for-default-PKCS-11-module.patch
+Patch42: downstream-Allow-krad-UDP-TCP-localhost-connection-with-FIPS.patch
+Patch43: Read-GSS-configuration-files-with-mtime-0.patch
+Patch44: Fix-integer-overflows-in-PAC-parsing.patch
 
 License: MIT
 URL: https://web.mit.edu/kerberos/www/
@@ -158,7 +161,7 @@ to install this package.
 %package libs
 Summary: The non-admin shared libraries used by Kerberos 5
 Requires: openssl-libs >= 1:3.0.0
-Requires: coreutils, gawk, grep, sed
+Requires: coreutils, gawk, sed
 Requires: keyutils-libs >= 1.5.8
 Requires: /etc/crypto-policies/back-ends/krb5.config
 
@@ -290,6 +293,7 @@ CPPFLAGS="`echo $DEFINES $INCLUDES`"
     CFLAGS="$CFLAGS" \
     CPPFLAGS="$CPPFLAGS" \
     SS_LIB="-lss" \
+    PKCS11_MODNAME="p11-kit-proxy.so" \
     --enable-shared \
     --runstatedir=/run \
     --localstatedir=%{_var}/kerberos \
@@ -436,7 +440,8 @@ sed -r -i -e 's|^libdir=/usr/lib(64)?$|libdir=/usr/lib|g' $RPM_BUILD_ROOT%{_bind
 
 # Workaround krb5-config reading too much from LDFLAGS.
 # https://bugzilla.redhat.com/show_bug.cgi?id=1997021
-sed -i -e "s/-specs=[^ ]*//g" $RPM_BUILD_ROOT%{_bindir}/krb5-config
+# https://bugzilla.redhat.com/show_bug.cgi?id=2048909
+sed -i -r -e 's/^(LDFLAGS=).*/\1/' $RPM_BUILD_ROOT%{_bindir}/krb5-config
 
 # Install processed man pages.
 for section in 1 5 8 ; do
@@ -465,12 +470,6 @@ rm -- "$RPM_BUILD_ROOT/%{_libdir}/krb5/plugins/preauth/test.so"
 
 %ldconfig_scriptlets libs
 
-%triggerun libs -- krb5-libs < 1.15.1-5
-if ! grep -q 'includedir /etc/krb5.conf.d' /etc/krb5.conf ; then
-    sed -i '1i # To opt out of the system crypto-policies configuration of krb5, remove the\n# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.\nincludedir /etc/krb5.conf.d/\n' /etc/krb5.conf
-fi
-exit 0
-
 %ldconfig_scriptlets server-ldap
 
 %post server
@@ -653,6 +652,35 @@ exit 0
 %{_libdir}/libkadm5srv_mit.so.*
 
 %changelog
+* Wed Nov 09 2022 Julien Rische <jrische@redhat.com> - 1.19.2-12
+- Fix integer overflows in PAC parsing (CVE-2022-42898)
+- Resolves: rhbz#2143010
+
+* Wed Jun 15 2022 Julien Rische <jrische@redhat.com> - 1.19.2-11
+- Allow libkrad UDP/TCP connection to localhost in FIPS mode
+- Resolves: rhbz#2082189
+- Read GSS configuration files with mtime 0
+
+* Mon May  2 2022 Julien Rische <jrische@redhat.com> - 1.19.2-10
+- Use p11-kit as default PKCS11 module
+- Resolves: rhbz#2073274
+- Try harder to avoid password change replay errors
+- Resolves: rhbz#2076965
+
+* Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-9
+- Fix libkrad client cleanup
+- Fixes rhbz#2072059
+
+* Tue Apr 05 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-8
+- Allow use of larger RADIUS attributes in krad library
+
+* Wed Mar 23 2022 Julien Rische <jrische@redhat.com> - 1.19.2-7
+- Use SHA-256 instead of SHA-1 for PKINIT CMS digest
+
+* Tue Feb  8 2022 Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.19.2-6
+- Drop old trigger scriplet
+- Reenable package notes and strip LDFLAGS from krb5-config (rhbz#2048909)
+
 * Wed Feb 02 2022 Alexander Bokovoy <abokovoy@redhat.com> - 1.19.2-5
 - Temporarily remove package note to unblock krb5-dependent packages
 - Resolves: rhbz#2048909