Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode

Set aes256-cts-hmac-sha384-192 as EXAMLE.COM master key in kdc.conf
Add AES SHA-2 HMAC family as EXAMPLE.COM supported etypes in kdc.conf
Resolves: rhbz#2068535

Strip debugging data from ksu executable file
Resolves: rhbz#2159643

Make tests compatible with sssd-client
Resolves: rhbz#2151513
Remove invalid password expiry warning
Resolves: rhbz#2121099
Update error checking for OpenSSL CMS_verify
Resolves: rhbz#2063838
New upstream version (1.20.1)
Resolves: rhbz#2016312
Fix integer overflows in PAC parsing (CVE-2022-42898)
Resolves: rhbz#2140971

Fix kprop for propagating dump files larger than 4GB
Resolves: rhbz#2133014

Restore "supportedCMSTypes" attribute in PKINIT preauth requests
Set SHA-512 or SHA-256 with RSA as preferred CMS signature algorithms
Resolves: rhbz#2068935

Fix libkrad client cleanup
Allow use of larger RADIUS attributes in krad library
Resolves: rhbz#2100351

Fix OpenSSL 3 MD5 encyption in FIPS mode
Allow libkrad UDP/TCP connection to localhost in FIPS mode
Resolves: rhbz#2068458

Use p11-kit as default PKCS11 module
Resolves: rhbz#2030981

Try harder to avoid password change replay errors
Resolves: rhbz#2075186

Use SHA-256 instead of SHA-1 for PKINIT CMS digest

Bypass FIPS restrictions to use KRB5KDF in case AES SHA-1 HMAC is enabled
Lazily load MD4/5 from OpenSSL if using RADIUS or RC4 enctype in FIPS mode

Remove -specs= from krb5-config output
Resolves #1997021

Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
Resolves: #1997602

Rebuilt for IMA sigs, glibc 2.34, aarch64 flags

Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)
Resolves: #1983733