CVE-2025-54882

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.

Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. In versions 0.8.0 through 0.9.21 and 1.0.0-beta through 1.1.0, Himmelblau stores the cloud TGT received during logon in the Kerberos credential cache. The created credential cache collection and received credentials are stored as world readable. This is fixed in versions 0.9.22 and 1.2.0. To work around this issue, remove all read access to Himmelblau caches for all users except for owners.

This update for himmelblau fixes the following issues:

Update to himmelblau 2.3.8 (jsc#PED-14511):

Security issues:

• CVE-2025-54882: world readable cloud TGT token (bsc#1247735).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257904).
• CVE-2026-31979: race condition when accessiung /tmp/krb5cc_<uid> (bsc#1259548).

Non security issues:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).

Changelog:

Version 2.3.8:

• Add PrivateTmp back to Tasks Daemon
• Drop dead code
• Drop krb5 ccache dir code
• Add a TODO comment
• Drop non working packaged krb5 snippet file
• Write kerberos config snippet
• Extend resolver interface to return kerberos config together with TGTs
• Backport SELinux fixes from main
• Use libkrimes to store TGTs

Version 2.3.7:

• cargo vet
• Fix AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
• Revert dependency change which broke the nightly build
• gen_dockerfiles: only himmelblaud has tpm feature, fix all others
• fix(build): gen_dockerfiles.py mutates shared features list mid-loop

Version 2.3.5:

• Better handle Intune API version
• Update make vet from main branch
• pam_himmelblau: call split_username once in chauthtok
• pam_himmelblau: return PAM_IGNORE in chauthtok for local users
• Don't attempt a DAG when Hello fails with SSPR demand

Version 2.3.4:

• deps(rust): bump the all-cargo-updates group across 1 directory with 8 updates
• Revert sketching update (which breaks SLE16 build)

Version 2.3.3:

• /var/cache/private/himmelblaud should not be created tmpfiles
• Updatee python vers for dataclasses dep
• deps(rust): bump the all-cargo-updates group across 1 directory with 3 updates
• Generate pin init service file systemd < 250
• Checkin missing himmelblaud.if file for SELinux
• Resolve typos in selinux package commands

Version 2.3.2:

• Compile SELinux policy at install time for cross-distro compatibility
• Improve PAM configuration on openSUSE/SLE
• Fix SELinux policy
• Add a git hook to ensure selinux policy is tested
• Ignore generated himmelblau-hsm-pin-init service file
• Refactor SELinux policy for cross-distro compatibility
• Fix NSS lookup for mapped local users
• Skip OS version compliance checks when min/max values are empty

Version 2.3.1:

• Remove references to qrcodegen (these are 3.x features)
• QR Greeter compatibility for old GNOME
• Enable QR greeter automatically
• ci: Use latest cargo-vet from git to fix CI
• Fix HSM pin migration failure on Debian/Ubuntu upgrades from v1.4.x

Version 2.3.0:

• Autostart the daemons on fresh install or upgrade
• Restart sshd when installing the ssh config
• Allow tasks daemon to write krb ccache
• Do not enumerate mapped users in NSS
• Update libhimmelblau to latest version
• Fix Tumbleweed build

Version 2.2.0:

• Update libhimmelblau to 0.8.x series
• deps(rust): bump the all-cargo-updates group with 17 updates
• Only use OpenSSH bug workaround for ssh service
• Fix debug noise from removing user from sudo group
• systemd: install files to /usr/lib/, not /etc/

Version 2.1.0:

• Fix nightly authselect build failure
• Generate the authselect profiles for each distro
• Improve pam config handling in aad-tool
• Make aad-tool configure-pam detect location of pam files

Version 2.0.5:

• /var/lib/private/himmelblaud should be owned by root
• Use tmpfiles.d to create himmelblaud private data directory
• deps(rust): bump the all-cargo-updates group with 13 updates

Version 2.0.4:

• Update kanidm_build_profiles mask version

• Utilize cargo vet from main

• Add policies cache patch via systemd-tmpfiles

• Fix man page comments about change idmap_range

• Stub picky-krb for osc build

• Stub a kanidm_build_profiles which builds in osc

• Ensure nss cache is created on Ubuntu/Debian

• Request a user…

These are all security issues fixed in the himmelblau-1.2.0+git.0.6befefc-1.1 package on the GA media of openSUSE Tumbleweed.

This update for himmelblau fixes the following issues:

Update to himmelblau 2.3.8 (jsc#PED-14511):

Security issues:

• CVE-2025-54882: world readable cloud TGT token (bsc#1247735).
• CVE-2025-58160: tracing-subscriber: Tracing log pollution (bsc#1249013).
• CVE-2026-25727: time: parsing of user-provided input by the RFC 2822 date parser can lead to stack exhaustion (bsc#1257904).
• CVE-2026-31979: race condition when accessiung /tmp/krb5cc_<uid> (bsc#1259548).

Non security issues:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).

Changelog:

Version 2.3.8:

• Add PrivateTmp back to Tasks Daemon
• Drop dead code
• Drop krb5 ccache dir code
• Add a TODO comment
• Drop non working packaged krb5 snippet file
• Write kerberos config snippet
• Extend resolver interface to return kerberos config together with TGTs
• Backport SELinux fixes from main
• Use libkrimes to store TGTs

Version 2.3.7:

• cargo vet
• Fix AWS-LC has PKCS7_verify Certificate Chain Validation Bypass
• Revert dependency change which broke the nightly build
• gen_dockerfiles: only himmelblaud has tpm feature, fix all others
• fix(build): gen_dockerfiles.py mutates shared features list mid-loop

Version 2.3.5:

• Better handle Intune API version
• Update make vet from main branch
• pam_himmelblau: call split_username once in chauthtok
• pam_himmelblau: return PAM_IGNORE in chauthtok for local users
• Don't attempt a DAG when Hello fails with SSPR demand

Version 2.3.4:

• deps(rust): bump the all-cargo-updates group across 1 directory with 8 updates
• Revert sketching update (which breaks SLE16 build)

Version 2.3.3:

• /var/cache/private/himmelblaud should not be created tmpfiles
• Updatee python vers for dataclasses dep
• deps(rust): bump the all-cargo-updates group across 1 directory with 3 updates
• Generate pin init service file systemd < 250
• Checkin missing himmelblaud.if file for SELinux
• Resolve typos in selinux package commands

Version 2.3.2:

• Compile SELinux policy at install time for cross-distro compatibility
• Improve PAM configuration on openSUSE/SLE
• Fix SELinux policy
• Add a git hook to ensure selinux policy is tested
• Ignore generated himmelblau-hsm-pin-init service file
• Refactor SELinux policy for cross-distro compatibility
• Fix NSS lookup for mapped local users
• Skip OS version compliance checks when min/max values are empty

Version 2.3.1:

• Remove references to qrcodegen (these are 3.x features)
• QR Greeter compatibility for old GNOME
• Enable QR greeter automatically
• ci: Use latest cargo-vet from git to fix CI
• Fix HSM pin migration failure on Debian/Ubuntu upgrades from v1.4.x

Version 2.3.0:

• Autostart the daemons on fresh install or upgrade
• Restart sshd when installing the ssh config
• Allow tasks daemon to write krb ccache
• Do not enumerate mapped users in NSS
• Update libhimmelblau to latest version
• Fix Tumbleweed build

Version 2.2.0:

• Update libhimmelblau to 0.8.x series
• deps(rust): bump the all-cargo-updates group with 17 updates
• Only use OpenSSH bug workaround for ssh service
• Fix debug noise from removing user from sudo group
• systemd: install files to /usr/lib/, not /etc/

Version 2.1.0:

• Fix nightly authselect build failure
• Generate the authselect profiles for each distro
• Improve pam config handling in aad-tool
• Make aad-tool configure-pam detect location of pam files

Version 2.0.5:

• /var/lib/private/himmelblaud should be owned by root
• Use tmpfiles.d to create himmelblaud private data directory
• deps(rust): bump the all-cargo-updates group with 13 updates

Version 2.0.4:

• Update kanidm_build_profiles mask version

• Utilize cargo vet from main

• Add policies cache patch via systemd-tmpfiles

• Fix man page comments about change idmap_range

• Stub picky-krb for osc build

• Stub a kanidm_build_profiles which builds in osc

• Ensure nss cache is created on Ubuntu/Debian

• Request a user…

This update for himmelblau fixes the following issues:

Update to version 2.3.9+git0.a9fd29b; (jsc#PED-14511):

• CVE-2026-34397: Fix LPE due to name collision during NSS fake-primary group lookup (bsc#1261324).
• CVE-2026-31979: Fix race condition when accessiung /tmp/krb5cc_uid (bsc#1259548).
• CVE-2026-25727: deps(rust): Bump the all-cargo-updates group with 8 updates (bsc#1257904).
• CVE-2025-58160: deps(rust): Bump tracing-subscriber in the cargo group (bsc#1249013).
• CVE-2025-54882: Fix Kerberos credential cache permissions (bsc#1247735).
• CVE-2025-53013: Fix permitted authentication with invalid Hello PIN (bsc#1245437).
• CVE-2024-11738: Fix rustls network-reachable panic in Acceptor::accept (bsc#1233949).

Other bug fixes:

• Fix SELinux module packaging to use standard policy macros (bsc#1258236).