An change was mad upstream to disallow use of RC4 by default (an additional configuration parameter has to be set to allow it):
https://github.com/krb5/krb5/commit/1b57a4d134bbd0e7c52d5885a92eccc815726463
This restriction is also part of MS-KILE:
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-kile/6cfc7b50-11ed-4b4d-846d-6f08f0812919
This change was reverted to avoid conflicts with the crypto-policy system. But it may still be needed for restricting use of RC4 for session keys specifically.
- duplicates
-
RHEL-88047 CVE-2025-3576: RC4 HMAC-MD5 checksum vulnerability enabling GSSAPI-protected message spoofing via MD5 collisions [rhel-10]
-
- Closed
-
- split to
-
RHEL-84872 [DEV Task]: Disallow use of RC4 HMAC-MD5 for session keys by default (CVE-2025-3576)
-
- Closed
-