A krb5 security update has been released for Red Hat Enterprise Linux
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: krb5 security update
Advisory ID: RHSA-2005:567-02
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-567.html
Issue date: 2005-07-12
Updated on: 2005-07-12
Product: Red Hat Enterprise Linux
Cross references: RHSA-2005:562
Obsoletes: RHSA-2005:330
CVE Names: CAN-2004-0175 CAN-2005-1174 CAN-2005-1175 CAN-2005-1689
----------------------------------------------------------------------
1. Summary:
Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.
This update has been rated as having important security impact by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
Kerberos is a networked authentication system that uses a trusted third party (a KDC) to authenticate clients and servers to each other.
A double-free flaw was found in the krb5_recvauth() routine which may be triggered by a remote unauthenticated attacker. Red Hat Enterprise Linux 4 contains checks within glibc that detect double-free flaws. Therefore, on Red Hat Enterprise Linux 4 successful exploitation of this issue can only lead to a denial of service (KDC crash). The Common Vulnerabilities and Exposures project assigned the name CAN-2005-1689 to this issue.
Daniel Wachdorf discovered a single byte heap overflow in the krb5_unparse_name() function, part of krb5-libs. Sucessful exploitation of this flaw would lead to a denial of service (crash). To trigger this flaw an attacker would need to have control of a kerberos realm that shares a cross-realm key with the target, making exploitation of this flaw unlikely.(CAN-2005-1175).
Daniel Wachdorf also discovered that in error conditions that may occur in response to correctly-formatted client requests, the Kerberos 5 KDC may attempt to free uninitialized memory. This could allow a remote attacker to cause a denial of service (KDC crash) (CAN-2005-1174).
Gaël Delalleau discovered an information disclosure issue in the way some telnet clients handle messages from a server. An attacker could construct a malicious telnet server that collects information from the environment of any victim who connects to it using the Kerberos-aware telnet client (CAN-2005-0488).
The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses the Kerberos-aware rcp to copy files from a malicious server (CAN-2004-0175).
All users of krb5 should update to these erratum packages, which contain backported patches to correct these issues. Red Hat would like to thank the MIT Kerberos Development Team for their responsible disclosure of these issues.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/):
157103 - CAN-2005-1174 krb5 buffer overflow, heap corruption in KDC (CAN-2005-1175)
159304 - CAN-2005-0488 telnet Information Disclosure Vulnerability
159756 - CAN-2005-1689 double-free in krb5_recvauth
161471 - krb5 krb5_principal_compare NULL pointer crash
161611 - CAN-2004-0175 malicious rsh server can cause rcp to write to arbitrary files
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/krb5-1.3.4-17.src.rpm
eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm
i386:
8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm
41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm
ia64:
e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm
23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm
47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm
ppc:
efa66e287518dd981a385f93dd087445 krb5-devel-1.3.4-17.ppc.rpm
b01ebd176e288cadf3288162d5d45997 krb5-libs-1.3.4-17.ppc.rpm
6b57eff4d9b5506b45b749500b848838 krb5-libs-1.3.4-17.ppc64.rpm
4642ab1a5a73cb1fb4985cf7aa63003e krb5-server-1.3.4-17.ppc.rpm
c4d951ee5954b2c7655c65af59e4cd6c krb5-workstation-1.3.4-17.ppc.rpm
s390:
748be68de3ed9f3d40ce624322dc555e krb5-devel-1.3.4-17.s390.rpm
f7b51e891da7442bf41d8297247dc1d5 krb5-libs-1.3.4-17.s390.rpm
bfb93446ef2ab7b8a6d2a0ca0786aca5 krb5-server-1.3.4-17.s390.rpm
ec219d6075667d8d7698e358d0d7e7ef krb5-workstation-1.3.4-17.s390.rpm
s390x:
2370a9ceabc738c716ae515f598d4713 krb5-devel-1.3.4-17.s390x.rpm
f7b51e891da7442bf41d8297247dc1d5 krb5-libs-1.3.4-17.s390.rpm
b251dee235fdaaddfbc02dcf1106f5eb krb5-libs-1.3.4-17.s390x.rpm
df7a2c26ac6a6f872ec3b8d33649bd8f krb5-server-1.3.4-17.s390x.rpm
79f44c1f3cf6e66892d6c40865ce8f72 krb5-workstation-1.3.4-17.s390x.rpm
x86_64:
6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm
197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm
9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/krb5-1.3.4-17.src.rpm
eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm
i386:
8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm
41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm
x86_64:
6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm
197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm
9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/krb5-1.3.4-17.src.rpm
eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm
i386:
8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm
41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm
ia64:
e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm
23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm
47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm
x86_64:
6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm
197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm
9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/krb5-1.3.4-17.src.rpm
eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm
i386:
8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm
41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm
ia64:
e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm
23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm
47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm
x86_64:
6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm
197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm
9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1689
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
----------------------------------------------------------------------
Red Hat Security Advisory
Synopsis: Important: krb5 security update
Advisory ID: RHSA-2005:567-02
Advisory URL: https://rhn.redhat.com/errata/RHSA-2005-567.html
Issue date: 2005-07-12
Updated on: 2005-07-12
Product: Red Hat Enterprise Linux
Cross references: RHSA-2005:562
Obsoletes: RHSA-2005:330
CVE Names: CAN-2004-0175 CAN-2005-1174 CAN-2005-1175 CAN-2005-1689
----------------------------------------------------------------------
1. Summary:
Updated krb5 packages that fix multiple security issues are now available for Red Hat Enterprise Linux 4.
This update has been rated as having important security impact by the Red Hat Security Response Team.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AS version 4 - i386, ia64, ppc, s390, s390x, x86_64
Red Hat Enterprise Linux Desktop version 4 - i386, x86_64
Red Hat Enterprise Linux ES version 4 - i386, ia64, x86_64
Red Hat Enterprise Linux WS version 4 - i386, ia64, x86_64
3. Problem description:
Kerberos is a networked authentication system that uses a trusted third party (a KDC) to authenticate clients and servers to each other.
A double-free flaw was found in the krb5_recvauth() routine which may be triggered by a remote unauthenticated attacker. Red Hat Enterprise Linux 4 contains checks within glibc that detect double-free flaws. Therefore, on Red Hat Enterprise Linux 4 successful exploitation of this issue can only lead to a denial of service (KDC crash). The Common Vulnerabilities and Exposures project assigned the name CAN-2005-1689 to this issue.
Daniel Wachdorf discovered a single byte heap overflow in the krb5_unparse_name() function, part of krb5-libs. Sucessful exploitation of this flaw would lead to a denial of service (crash). To trigger this flaw an attacker would need to have control of a kerberos realm that shares a cross-realm key with the target, making exploitation of this flaw unlikely.(CAN-2005-1175).
Daniel Wachdorf also discovered that in error conditions that may occur in response to correctly-formatted client requests, the Kerberos 5 KDC may attempt to free uninitialized memory. This could allow a remote attacker to cause a denial of service (KDC crash) (CAN-2005-1174).
Gaël Delalleau discovered an information disclosure issue in the way some telnet clients handle messages from a server. An attacker could construct a malicious telnet server that collects information from the environment of any victim who connects to it using the Kerberos-aware telnet client (CAN-2005-0488).
The rcp protocol allows a server to instruct a client to write to arbitrary files outside of the current directory. This could potentially cause a security issue if a user uses the Kerberos-aware rcp to copy files from a malicious server (CAN-2004-0175).
All users of krb5 should update to these erratum packages, which contain backported patches to correct these issues. Red Hat would like to thank the MIT Kerberos Development Team for their responsible disclosure of these issues.
4. Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
This update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command:
up2date
This will start an interactive process that will result in the appropriate RPMs being upgraded on your system.
5. Bug IDs fixed (http://bugzilla.redhat.com/):
157103 - CAN-2005-1174 krb5 buffer overflow, heap corruption in KDC (CAN-2005-1175)
159304 - CAN-2005-0488 telnet Information Disclosure Vulnerability
159756 - CAN-2005-1689 double-free in krb5_recvauth
161471 - krb5 krb5_principal_compare NULL pointer crash
161611 - CAN-2004-0175 malicious rsh server can cause rcp to write to arbitrary files
6. RPMs required:
Red Hat Enterprise Linux AS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4AS/en/os/SRPMS/krb5-1.3.4-17.src.rpm
eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm
i386:
8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm
41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm
ia64:
e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm
23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm
47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm
ppc:
efa66e287518dd981a385f93dd087445 krb5-devel-1.3.4-17.ppc.rpm
b01ebd176e288cadf3288162d5d45997 krb5-libs-1.3.4-17.ppc.rpm
6b57eff4d9b5506b45b749500b848838 krb5-libs-1.3.4-17.ppc64.rpm
4642ab1a5a73cb1fb4985cf7aa63003e krb5-server-1.3.4-17.ppc.rpm
c4d951ee5954b2c7655c65af59e4cd6c krb5-workstation-1.3.4-17.ppc.rpm
s390:
748be68de3ed9f3d40ce624322dc555e krb5-devel-1.3.4-17.s390.rpm
f7b51e891da7442bf41d8297247dc1d5 krb5-libs-1.3.4-17.s390.rpm
bfb93446ef2ab7b8a6d2a0ca0786aca5 krb5-server-1.3.4-17.s390.rpm
ec219d6075667d8d7698e358d0d7e7ef krb5-workstation-1.3.4-17.s390.rpm
s390x:
2370a9ceabc738c716ae515f598d4713 krb5-devel-1.3.4-17.s390x.rpm
f7b51e891da7442bf41d8297247dc1d5 krb5-libs-1.3.4-17.s390.rpm
b251dee235fdaaddfbc02dcf1106f5eb krb5-libs-1.3.4-17.s390x.rpm
df7a2c26ac6a6f872ec3b8d33649bd8f krb5-server-1.3.4-17.s390x.rpm
79f44c1f3cf6e66892d6c40865ce8f72 krb5-workstation-1.3.4-17.s390x.rpm
x86_64:
6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm
197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm
9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm
Red Hat Enterprise Linux Desktop version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4Desktop/en/os/SRPMS/krb5-1.3.4-17.src.rpm
eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm
i386:
8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm
41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm
x86_64:
6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm
197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm
9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm
Red Hat Enterprise Linux ES version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4ES/en/os/SRPMS/krb5-1.3.4-17.src.rpm
eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm
i386:
8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm
41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm
ia64:
e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm
23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm
47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm
x86_64:
6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm
197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm
9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm
Red Hat Enterprise Linux WS version 4:
SRPMS:
ftp://updates.redhat.com/enterprise/4WS/en/os/SRPMS/krb5-1.3.4-17.src.rpm
eb03ea1204d767bfdd5c651047474bc8 krb5-1.3.4-17.src.rpm
i386:
8711751b5bbc9a586c05c5f6122758df krb5-devel-1.3.4-17.i386.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
36077a459b9e60055f1c4f97fe54b7e4 krb5-server-1.3.4-17.i386.rpm
41a717b95454e404d379a85ce691aa72 krb5-workstation-1.3.4-17.i386.rpm
ia64:
e022bc5b3a7fa4aa58c8df9ac8d4eb1c krb5-devel-1.3.4-17.ia64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
05f9346a3d1749ed344c1b6886ce8363 krb5-libs-1.3.4-17.ia64.rpm
23d98f10451ba361f99e8fd01da62729 krb5-server-1.3.4-17.ia64.rpm
47c4e458b181a4fc2d99ad110c35e80e krb5-workstation-1.3.4-17.ia64.rpm
x86_64:
6810bc5ab22a5b9d8aef3728fdbf239c krb5-devel-1.3.4-17.x86_64.rpm
d672310384822836b3257c85777426ab krb5-libs-1.3.4-17.i386.rpm
24cb00892ca0c1d278cb6d92568145a0 krb5-libs-1.3.4-17.x86_64.rpm
197573ea8764dbf467df0c71546facdc krb5-server-1.3.4-17.x86_64.rpm
9c5d3e5cb109a13c1140cf2060e768b8 krb5-workstation-1.3.4-17.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from
https://www.redhat.com/security/team/key/#package
7. References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2004-0175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1174
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1175
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2005-1689
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact details at https://www.redhat.com/security/team/contact/
Copyright 2005 Red Hat, Inc.
