New upstream version (1.21.1)
Fix double-free in KDC TGS processing (CVE-2023-39975)
Add support for "pac_privsvr_enctype" KDB string attribute

Do not disable PKINIT if some of the well-known DH groups are unavailable
Make PKINIT CMS SHA-1 signature verification available in FIPS mode
Allow to set PAC ticket signature as optional

Fix datetime parsing in kadmin on s390x

Fix double free on kdb5_util key creation failure

Add support for MS-PAC extended KDC signature (CVE-2022-37967)

Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode

Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf

Strip debugging data from ksu executable file

Make tests compatible with sssd-client
Remove invalid password expiry warning
Update error checking for OpenSSL CMS_verify
New upstream version (1.20.1)
Fix integer overflows in PAC parsing (CVE-2022-42898)

Fix kprop for propagating dump files larger than 4GB

Restore "supportedCMSTypes" attribute in PKINIT preauth requests
Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms

Fix libkrad client cleanup
Allow use of larger RADIUS attributes in krad library

Fix OpenSSL 3 MD5 encyption in FIPS mode
Allow libkrad UDP/TCP connection to localhost in FIPS mode

Use p11-kit as default PKCS11 module

Try harder to avoid password change replay errors

Use SHA-256 instead of SHA-1 for PKINIT CMS digest