Add missing note about SA-2010-007

[krb5.git] / README

diff --git a/README b/README
index fc27b570a1b7cbb199bf4f97867e45279778be10..766a02a717271d485d9a8cdceb747d63cc6d34f5 100644 (file)
--- a/README
+++ b/README
@@ -62,6 +62,7 @@ Major changes in 1.9
 
 Code quality:
 
+* Fix MITKRB5-SA-2010-007 checksum vulnerabilities (CVE-2010-1324 and others)
 * Python-based testing framework
 * DAL cleanup
 
@@ -73,19 +74,35 @@ Developer experience:
 
 Performance:
 
-* Account lockout performance improvements
+* Account lockout performance improvements -- allow disabling of some
+  account lockout functionality to reduce the number of write
+  operations to the database during authentication
 
 Administrator experience:
 
-* Trace logging
-* Plugin interface for password sync
-* Plugin interface for password quality checks
+* Trace logging -- for easier diagnosis of configuration problems
+
+* Support for purging old keys (e.g. from "cpw -randkey -keepold")
+
+* Plugin interface for password sync -- based on proposed patches by
+  Russ Allbery that support his krb5-sync package
+
+* Plugin interface for password quality checks -- enables pluggable
+  password quality checks similar to Russ Allbery's krb5-strength
+  package
+
 * Configuration file validator
-* KDC support for SecurID preauthentication
+
+* KDC support for SecurID preauthentication -- This is the old SAM-2
+  protocol, implemented to support existing deployments, not the
+  in-progress FAST-OTP work.
 
 Protocol evolution:
 
-* IAKERB
+* IAKERB -- a mechanism for tunneling Kerberos KDC transactions over
+  GSS-API, enabling clients to authenticate to services even when the
+  clients cannot directly reach the KDC that serves the services.
+
 * Camellia encryption (experimental; disabled by default)
 
 krb5-1.9 changes by ticket ID
@@ -165,6 +182,11 @@ krb5-1.9 changes by ticket ID
 6827    SA-2010-007 Checksum vulnerabilities (CVE-2010-1324 and others)
 6828    Install kadm5_hook_plugin.h
 6829    Implement restrict_anonymous_to_tgt realm flag
+6838    Regression in renewable handling
+6839    handle MS PACs that lack server checksum
+6840    typo in plugin-related error message
+6841    memory leak in changepw.c
+6842    Ensure time() is prototyped in g_accept_sec_context.c
 
 Acknowledgements
 ----------------
@@ -286,6 +308,7 @@ reports, suggestions, and valuable resources:
     Ákos Frohner
     Marcus Granado
     Scott Grizzard
+    Helmut Grohne
     Steve Grubb
     Philip Guenther
     Dominic Hargreaves