Heimdal 7.7 bug fix release announcement

This is a cryptographically signed message in MIME format.

--===============1805302734880381368==
Content-Type: multipart/signed; protocol="application/pkcs7-signature"; micalg=sha-256; boundary="------------ms070201070401060207080304"

This is a cryptographically signed message in MIME format.

--------------ms070201070401060207080304
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: quoted-printable

Dear Heimdal Community,

A team consisting of staff from Two Sigma Open Source and AuriStor are
pleased to announce the release of Heimdal 7.7.

The release download page is:

    https://github.com/heimdal/heimdal/releases/tag/heimdal-7.7.0

The source tarball can be downloaded from:


https://github.com/heimdal/heimdal/releases/download/heimdal-7.7.0/heimda=
l-7.7.0.tar.gz

https://github.com/heimdal/heimdal/releases/download/heimdal-7.7.0/heimda=
l-7.7.0.tar.gz.asc

   SHA256(heimdal-7.7.0.tar.gz)=3D
f02d3314d634cc55eb9cf04a1eae0d96b293e45a1f837de9d894e800161b7d1b
    SHA1(heimdal-7.7.0.tar.gz)=3D 5dd16703be7255f66a4d65440f0c622aeeca60d=
9

The signature key fingerprint is: E659 41B7 1CF3 C459 A34F  A89C 45E7
572A 28CD 8CC8

Bug fixes

    PKCS#11 hcrypto back-end
    . initialize the p11_module_load function list
    . verify that not only is a mechanism present but that its mechanism
    info states that it offers the required encryption, decryption or
    digest services

    krb5:
    . Starting with 7.6, Heimdal permitted requesting authenticated
      anonymous tickets. However, it did not verify that a KDC in fact
      returned an anonymous ticket when one was requested.
    . Cease setting the KDCOption reaquest_anonymous flag when issuing
      S4UProxy (constrained delegation) TGS requests.
    . when the Win2K PKINIT compatibility option is set, do
      not require krbtgt otherName to match when validating KDC
      certificate.
    . set PKINIT_BTMM flag per Apple implementation
    . use memset_s() instead of memset()

    kdc:
    . When generating KRB5SignedPath in the AS, use the reply client
      name rather than the one from the request, so validation will
      work correctly in the TGS.
    . allow checksum of PA-FOR-USER to be HMAC_MD5. Even if TGT used
      an enctype with a different checksum. Per [MS-SFU] 2.2.1
      PA-FOR-USER the checksum is always HMAC_MD5, and that's what
      Windows and MIT clients send.

      In Heimdal both the client and kdc use instead the
      checksum of the TGT, and therefore work with each other
      but Windows and MIT clients fail against Heimdal KDC.

      Both Windows and MIT KDC would allow any keyed checksum
      to be used so Heimdal client work fine against it.

      Change Heimdal KDC to allow HMAC_MD5 even for non RC4
      based TGT in order to support per-spec clients.
    . use memset_s() instead of memset()
    . Detect Heimdal 1.0 through 7.6 clients that issue S4UProxy
      (constrained delegation) TGS Requests with the request
      anonymous flag set. These requests will be treated as
      S4UProxy requests and not anonymous requests.

    HDB:
    . Set SQLite3 backend default page size to 8KB.
    . Add hdb_set_sync() method

    kadmind:
    . disable HDB sync during database load avoiding unnecessary
      disk i/o.

    ipropd:
    . disable HDB sync during receive_everything. Doing an fsync
      per-record when receiving the complete HDB is a performance
      disaster. Among other things, if the HDB is very large, then
      one slave receving a full HDB can cause other slaves to timeout
      and, if HDB write activity is high enough to cause iprop log
      truncation, then also need full syncs, which leads to a cycle of
      full syncs for all slaves until HDB write activity drops.
      Allowing the iprop log to be larger helps, but improving
      receive_everything() performance helps even more.

    kinit:
    . Anonymous PKINIT tickets discard the realm information used
      to locate the issuing AS. Store the issuing realm in the
      credentials cache in order to locate a KDC which can renew them.
    . Do not leak the result of krb5_cc_get_config() when determining
      anonymous PKINIT start realm.

    klist:
    . Show transited-policy-checked, ok-as-delegate and anonymous
      flags when listing credentials.

    tests:
    . Regenerate certs so that they expire before the 2038 armageddon
      so the test suite will pass on 32-bit operating systems until the
      underlying issues can be resolved.

    Solaris:
    . Define _STDC_C11_BCI for memset_s prototype

    build tooling:
    . Convert from python 2 to python 3

    documentation
    . rename verify-password to verify-password-quality
    . hprop default mode is encrypt
    . kadmind "all" permission does not include "get-keys"
    . verify-password-quality might not be stateless

--=20
   The Heimdal Release Team.


--------------ms070201070401060207080304
Content-Type: application/pkcs7-signature; name="smime.p7s"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="smime.p7s"
Content-Description: S/MIME Cryptographic Signature

MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADCABgkqhkiG9w0BBwEAAKCC
DJowggYBMIIE6aADAgECAhBAAWafTz5dAElKUO3y42hlMA0GCSqGSIb3DQEBCwUAMDoxCzAJ
BgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVuVHJ1c3QxFzAVBgNVBAMTDlRydXN0SUQgQ0EgQTEy
MB4XDTE4MTAyMzA1MDQyMloXDTE5MTEwMzA1MDQyMlowgZUxNTAzBgNVBAsMLFZlcmlmaWVk
IEVtYWlsOiBqYWx0bWFuQHNlY3VyZS1lbmRwb2ludHMuY29tMSswKQYJKoZIhvcNAQkBFhxq
YWx0bWFuQHNlY3VyZS1lbmRwb2ludHMuY29tMS8wLQYKCZImiZPyLGQBARMfQTAxNDI3RTAw
MDAwMTY2OUY0RjNFMjcwMDAwMzFGQjCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEB
AJTyhcbPAvKyN1Vs9gjMN6oYnNwvoje6fdgl1mlqAkeIjASHSt1rupAuwXDcTCNVo7k4veY3
bmY9/q32DigX84dt/a15AQDBYhuCn0b5KKTkxOFTq0feIg2NjTz5w4Qnl7fsycxOeJurQXKT
wS655O4M3iGb0Y+txxCLwFfWD9p2TQ/nbZXmiCk0Kb+Zsd3IIMwpQ9JU9lSsQqIUzNZ+/3gE
eY9oAz7gEWHiOxp/0rnR0DKSqVIS0e7kVhBXjJ59G8iCWMoeSNVy1iVBcLz2TUt8HsEVUPjI
rsasYjbBt/PoHXZsNvJ/eN7I3KNiWf00ubf+4kzo92l31VJ/PkwEQNcCAwEAAaOCAqUwggKh
MA4GA1UdDwEB/wQEAwIFoDCBhAYIKwYBBQUHAQEEeDB2MDAGCCsGAQUFBzABhiRodHRwOi8v
Y29tbWVyY2lhbC5vY3NwLmlkZW50cnVzdC5jb20wQgYIKwYBBQUHMAKGNmh0dHA6Ly92YWxp
ZGF0aW9uLmlkZW50cnVzdC5jb20vY2VydHMvdHJ1c3RpZGNhYTEyLnA3YzAfBgNVHSMEGDAW
gBSkc9rvaTWKdcygGXsIMvhrieRC7DAJBgNVHRMEAjAAMIIBLAYDVR0gBIIBIzCCAR8wggEb
BgtghkgBhvkvAAYLATCCAQowSgYIKwYBBQUHAgEWPmh0dHBzOi8vc2VjdXJlLmlkZW50cnVz
dC5jb20vY2VydGlmaWNhdGVzL3BvbGljeS90cy9pbmRleC5odG1sMIG7BggrBgEFBQcCAjCB
rhqBq1RoaXMgVHJ1c3RJRCBDZXJ0aWZpY2F0ZSBoYXMgYmVlbiBpc3N1ZWQgaW4gYWNjb3Jk
YW5jZSB3aXRoIApJZGVuVHJ1c3QncyBUcnVzdElEIENlcnRpZmljYXRlIFBvbGljeSBmb3Vu
ZCBhdCBodHRwczovL3NlY3VyZS5pZGVudHJ1c3QuY29tL2NlcnRpZmljYXRlcy9wb2xpY3kv
dHMvaW5kZXguaHRtbDBFBgNVHR8EPjA8MDqgOKA2hjRodHRwOi8vdmFsaWRhdGlvbi5pZGVu
dHJ1c3QuY29tL2NybC90cnVzdGlkY2FhMTIuY3JsMCcGA1UdEQQgMB6BHGphbHRtYW5Ac2Vj
dXJlLWVuZHBvaW50cy5jb20wHQYDVR0OBBYEFJdlICa5IVm/mQsa1LIql1jf/0BXMB0GA1Ud
JQQWMBQGCCsGAQUFBwMCBggrBgEFBQcDBDANBgkqhkiG9w0BAQsFAAOCAQEAvSWHh+2vqTbu
65C4E+eXKv9Wz5LzqJNGWbkMq0a4/LswbvpWgG3AmFqeWXmbjfoFxWjnltt4mAYH2s/YCE9X
74kc7TXcRW+GKLGbazW2v/gffBYHudxjtIJRvQpcsiqqYRI0eVCer3kRdAPuEYz+62y1CACP
qwvaNo4fSHCSEqLDglgxFw7bNs0xV4Fb0yw4L4bv1zsnT6hrNQ4ibJEqQ7Ciq1sDRAGc4SmV
P9I0rbCV6mYlxxOEvvUPFfppp4/YAKTLtXuzB+QeTW8fR1HvVbRZitnvTEBVP8ChDwhlj6NA
l16ZeJWeo+Wru3Lv4HCV2PuKyJjKoFYyr6Y3GjZ3ZzCCBpEwggR5oAMCAQICEQD53lZ/yU0M
d3D5YBtS2hU7MA0GCSqGSIb3DQEBCwUAMEoxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVu
VHJ1c3QxJzAlBgNVBAMTHklkZW5UcnVzdCBDb21tZXJjaWFsIFJvb3QgQ0EgMTAeFw0xNTAy
MTgyMjI1MTlaFw0yMzAyMTgyMjI1MTlaMDoxCzAJBgNVBAYTAlVTMRIwEAYDVQQKEwlJZGVu
VHJ1c3QxFzAVBgNVBAMTDlRydXN0SUQgQ0EgQTEyMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
MIIBCgKCAQEA0ZFNPM8KJzSSrkvpmtQla3ksT+fq1s9c+Ea3YSC/umUkygSm9UkkOoaoNjKZ
oCx3wef1kwC4pQQV2XHk+AKR+7uMvnOCIw2cAVUP0/Kuy4X6miqaXGGVDTqwVjaFuFCRVVDT
QoI2BTMpwFQi+O/TjD5+E0+TAZbkzsB7krk4YUbA6hFyT0YboxRUq9M2QHDb+80w53b1UZVO
1HS2Mfk9LnINeyzjxiXU/iENK07YvjBOxbY/ftAYPbv/9cY3wrpqZYHoXZc6B9/8+aVCNA45
FP3k+YuTDC+ZrmePQBLQJWnyS/QrZEdXsaieWUqkUMxPQKTExArCiP61YRYlOIMpKwIDAQAB
o4ICgDCCAnwwgYkGCCsGAQUFBwEBBH0wezAwBggrBgEFBQcwAYYkaHR0cDovL2NvbW1lcmNp
YWwub2NzcC5pZGVudHJ1c3QuY29tMEcGCCsGAQUFBzAChjtodHRwOi8vdmFsaWRhdGlvbi5p
ZGVudHJ1c3QuY29tL3Jvb3RzL2NvbW1lcmNpYWxyb290Y2ExLnA3YzAfBgNVHSMEGDAWgBTt
RBnA0/AGi+6ke75C5yZUyI42djAPBgNVHRMBAf8EBTADAQH/MIIBIAYDVR0gBIIBFzCCARMw
ggEPBgRVHSAAMIIBBTCCAQEGCCsGAQUFBwICMIH0MEUWPmh0dHBzOi8vc2VjdXJlLmlkZW50
cnVzdC5jb20vY2VydGlmaWNhdGVzL3BvbGljeS90cy9pbmRleC5odG1sMAMCAQEagapUaGlz
IFRydXN0SUQgQ2VydGlmaWNhdGUgaGFzIGJlZW4gaXNzdWVkIGluIGFjY29yZGFuY2Ugd2l0
aCBJZGVuVHJ1c3QncyBUcnVzdElEIENlcnRpZmljYXRlIFBvbGljeSBmb3VuZCBhdCBodHRw
czovL3NlY3VyZS5pZGVudHJ1c3QuY29tL2NlcnRpZmljYXRlcy9wb2xpY3kvdHMvaW5kZXgu
aHRtbDBKBgNVHR8EQzBBMD+gPaA7hjlodHRwOi8vdmFsaWRhdGlvbi5pZGVudHJ1c3QuY29t
L2NybC9jb21tZXJjaWFscm9vdGNhMS5jcmwwHQYDVR0lBBYwFAYIKwYBBQUHAwIGCCsGAQUF
BwMEMA4GA1UdDwEB/wQEAwIBhjAdBgNVHQ4EFgQUpHPa72k1inXMoBl7CDL4a4nkQuwwDQYJ
KoZIhvcNAQELBQADggIBAA3hgq7S+/TrYxl+D7ExI1Rdgq8fC9kiT7ofWlSaK/IMjgjoDfBb
PGWvzdkmbSgYgXo8GxuAon9+HLIjNv68BgUmbIjwj/SYaVz6chA25XZdjxzKk+hUkqCmfOn/
twQJeRfxHg3I+0Sfwp5xs10YF0RobhrsCRne6OUmh9mph0fE3b21k90OVnx9Hfr+YAV4ISrT
A6045zQTKGzb370whliPLFo+hNL6XzEty5hfdFaWKtHIfpE994CLmTJI4SEbWq40d7TpAjCm
KCPIVPq/+9GqggGvtakM5K3VXNc9VtKPU9xYGCTDIYoeVBQ65JsdsdyM4PzDzAdINsv4vaF7
yE03nh2jLV7XAkcqad9vS4EB4hKjFFsmcwxa+ACUfkVWtBaWBqN4f/o1thsFJHEAu4Q6oRB6
mYkzqrPigPazF2rgYw3lp0B1gSzCRj+jRtErIVdMPeZ2p5Fdx7SNhBtabuhqmpJkFxwW9SBg
6sHvy0HpzVvEiBpApFKG1ZHXMwzQl+pR8P27wWDsblJU7Qgb8ZzGRK9l5GOFhxtN+oXZ4CCm
unLMtaZ2vSai7du/VKrg64GGZNAKerEBevjJVNFgeSnmUK9GB4kCZ7U5NWlU+2H87scntW4Q
/0Y6vqQJcJeaMHg/dQnahTQ2p+hB1xJJK32GWIAucTFMSOKLbQHadIOiMYIDFDCCAxACAQEw
TjA6MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MRcwFQYDVQQDEw5UcnVzdElE
IENBIEExMgIQQAFmn08+XQBJSlDt8uNoZTANBglghkgBZQMEAgEFAKCCAZcwGAYJKoZIhvcN
AQkDMQsGCSqGSIb3DQEHATAcBgkqhkiG9w0BCQUxDxcNMTkwNjA4MDE0MTU1WjAvBgkqhkiG
9w0BCQQxIgQgu0aXe8xatZ98vKGD6yFFeZjJsbq7MHaCnY3cZCozPwUwXQYJKwYBBAGCNxAE
MVAwTjA6MQswCQYDVQQGEwJVUzESMBAGA1UEChMJSWRlblRydXN0MRcwFQYDVQQDEw5UcnVz
dElEIENBIEExMgIQQAFmn08+XQBJSlDt8uNoZTBfBgsqhkiG9w0BCRACCzFQoE4wOjELMAkG
A1UEBhMCVVMxEjAQBgNVBAoTCUlkZW5UcnVzdDEXMBUGA1UEAxMOVHJ1c3RJRCBDQSBBMTIC
EEABZp9PPl0ASUpQ7fLjaGUwbAYJKoZIhvcNAQkPMV8wXTALBglghkgBZQMEASowCwYJYIZI
AWUDBAECMAoGCCqGSIb3DQMHMA4GCCqGSIb3DQMCAgIAgDANBggqhkiG9w0DAgIBQDAHBgUr
DgMCBzANBggqhkiG9w0DAgIBKDANBgkqhkiG9w0BAQEFAASCAQB8eqmpDBxYP7gGOnd9vk90
bYdD3pDd9OJmr3VFSyANAEYHz72PTUGLkhABzI0FCSgUZPB2ce2g8yVJcP0i05UP3SfC9Xzw
U8aW/2x6nNFkC7SGN5UzhnTKtS5HPRjf1j/6Ak4/3oWnhZEmbWsRi/qI/bUZdFxR6axhLj5v
1t1qV6ODpG8k+bo+IH64cmZMbNYWSZTGRgaeTG2XFVKBHBywmnxfinUKDM4BwU4UZujhWcsI
zn5cSG3sngS+7Z+fnXUzw6Wb+X0INdy+mHhTW7wC3A7A5ZS0vfUPrPKdfe49cOGL2b+S2a2L
4l3sv3Bi7pn7ivTURJ34ykFqqegc1SNUAAAAAAAA
--------------ms070201070401060207080304--


--===============1805302734880381368==
Content-Type: text/plain; charset="utf-8"
MIME-Version: 1.0
Content-Transfer-Encoding: base64
Content-Disposition: inline

X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KSGVpbWRhbC1h
bm5vdW5jZSBtYWlsaW5nIGxpc3QKSGVpbWRhbC1hbm5vdW5jZUBoNWwub3JnCmh0dHBzOi8vd3d3
Lmg1bC5vcmcvbWFpbG1hbi9saXN0aW5mby9oZWltZGFsLWFubm91bmNlCg==

--===============1805302734880381368==--