diff --git a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/Manifest b/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/Manifest
index dfcf9ea639..a5005ab76f 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/Manifest
+++ b/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/Manifest
@@ -1 +1 @@
-DIST krb5-1.18.2.tar.gz 8713927 BLAKE2B f0eb34e67adcb86f347c59ec6ef74970a57530cc56336a84909f852cd6135079ea89828e77c906a272f54e0faf6a4a0497f2b648446eb9d048d1c51e4ec513af SHA512 7cbb1b28e677fea3e0794e93951f3caaa2c49bb1175dd187951e72a466cc69d96c3b833d838000fe911c1a437d96a558e550f27c53a8b332fb9dfc7cbb7ec44c
+DIST krb5-1.19.2.tar.gz 8741053 BLAKE2B 963722721201e75381c91a2af6e982f569a5b1602beb2d1ded83d35f6f914235a6ed91e5d54f56c97e94921a32ed27c49aded258327966ee13d39485208c38d8 SHA512 b90d6ed0e1e8a87eb5cb2c36d88b823a6a6caabf85e5d419adb8a930f7eea09a5f8491464e7e454cca7ba88be09d19415962fe0036ad2e31fc584f9fc0bbd470
diff --git a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/CVE-2020-28196.patch b/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/CVE-2020-28196.patch
deleted file mode 100644
index 486078437e..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/CVE-2020-28196.patch
+++ /dev/null
@@ -1,71 +0,0 @@
-diff --git a/src/lib/krb5/asn.1/asn1_encode.c b/src/lib/krb5/asn.1/asn1_encode.c
-index a160cf4fe8..cd6b879f77 100644
---- a/lib/krb5/asn.1/asn1_encode.c
-+++ b/lib/krb5/asn.1/asn1_encode.c
-@@ -356,7 +356,7 @@ make_tag(asn1buf *buf, const taginfo *t, size_t len)
- static krb5_error_code
- get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out,
-         const uint8_t **contents_out, size_t *clen_out,
--        const uint8_t **remainder_out, size_t *rlen_out)
-+        const uint8_t **remainder_out, size_t *rlen_out, int recursion)
- {
-     krb5_error_code ret;
-     uint8_t o;
-@@ -394,9 +394,11 @@ get_tag(const uint8_t *asn1, size_t len, taginfo *tag_out,
-         /* Indefinite form (should not be present in DER, but we accept it). */
-         if (tag_out->construction != CONSTRUCTED)
-             return ASN1_MISMATCH_INDEF;
-+        if (recursion >= 32)
-+            return ASN1_OVERFLOW;
-         p = asn1;
-         while (!(len >= 2 && p[0] == 0 && p[1] == 0)) {
--            ret = get_tag(p, len, &t, &c, &clen, &p, &len);
-+            ret = get_tag(p, len, &t, &c, &clen, &p, &len, recursion + 1);
-             if (ret)
-                 return ret;
-         }
-@@ -613,7 +615,7 @@ split_der(asn1buf *buf, uint8_t *const *der, size_t len, taginfo *tag_out)
-     const uint8_t *contents, *remainder;
-     size_t clen, rlen;
- 
--    ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen);
-+    ret = get_tag(*der, len, tag_out, &contents, &clen, &remainder, &rlen, 0);
-     if (ret)
-         return ret;
-     if (rlen != 0)
-@@ -1199,7 +1201,7 @@ decode_atype(const taginfo *t, const uint8_t *asn1, size_t len,
-         const uint8_t *rem;
-         size_t rlen;
-         if (!tag->implicit) {
--            ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen);
-+            ret = get_tag(asn1, len, &inner_tag, &asn1, &len, &rem, &rlen, 0);
-             if (ret)
-                 return ret;
-             /* Note: we don't check rlen (it should be 0). */
-@@ -1420,7 +1422,7 @@ decode_sequence(const uint8_t *asn1, size_t len, const struct seq_info *seq,
-     for (i = 0; i < seq->n_fields; i++) {
-         if (len == 0)
-             break;
--        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
-+        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
-         if (ret)
-             goto error;
-         /*
-@@ -1478,7 +1480,7 @@ decode_sequence_of(const uint8_t *asn1, size_t len,
-     *seq_out = NULL;
-     *count_out = 0;
-     while (len > 0) {
--        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len);
-+        ret = get_tag(asn1, len, &t, &contents, &clen, &asn1, &len, 0);
-         if (ret)
-             goto error;
-         if (!check_atype_tag(elemtype, &t)) {
-@@ -1584,7 +1586,7 @@ k5_asn1_full_decode(const krb5_data *code, const struct atype_info *a,
- 
-     *retrep = NULL;
-     ret = get_tag((uint8_t *)code->data, code->length, &t, &contents,
--                  &clen, &remainder, &rlen);
-+                  &clen, &remainder, &rlen, 0);
-     if (ret)
-         return ret;
-     /* rlen should be 0, but we don't check it (and due to padding in
diff --git a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-1.18.2-autoconf-2.70.patch b/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-1.18.2-autoconf-2.70.patch
deleted file mode 100644
index 6741c47e0d..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-1.18.2-autoconf-2.70.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-https://bugs.gentoo.org/778167
-
-From f78edbe30816f049e1360cb6e203fabfdf7b98df Mon Sep 17 00:00:00 2001
-From: Sergei Trofimovich <slyfox@gentoo.org>
-Date: Fri, 6 Nov 2020 08:14:57 +0000
-Subject: [PATCH] Fix compatibility with upcoming autoconf 2.70
-
-Mainline autoconf generates no shell code for AC_CONFIG_AUX_DIR().
-Call it unconditionally to avoid a syntax error.
-
-[ghudson@mit.edu: rewrote commit message]
-
-ticket: 8960 (new)
-tags: pullup
-target_version: 1.18-next
-target_version: 1.17-next
----
- src/aclocal.m4 | 6 +-----
- 1 file changed, 1 insertion(+), 5 deletions(-)
-
---- src/aclocal.m4
-+++ src/aclocal.m4
-@@ -13,11 +13,7 @@ fi
- ac_topdir=$srcdir/$ac_reltopdir
- ac_config_fragdir=$ac_reltopdir/config
- # echo "Looking for $srcdir/$ac_config_fragdir"
--if test -d "$srcdir/$ac_config_fragdir"; then
--  AC_CONFIG_AUX_DIR(K5_TOPDIR/config)
--else
--  AC_MSG_ERROR([can not find config/ directory in $ac_reltopdir])
--fi
-+AC_CONFIG_AUX_DIR(K5_TOPDIR/config)
- ])dnl
- dnl
- dnl Version info.
diff --git a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-warn-crossbuild.patch b/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-warn-crossbuild.patch
deleted file mode 100644
index 37d6eca0b6..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5-warn-crossbuild.patch
+++ /dev/null
@@ -1,35 +0,0 @@
-diff --git a/aclocal.m4 b/aclocal.m4
-index 8709a7f5..fe6d41b4 100644
---- a/aclocal.m4
-+++ b/aclocal.m4
-@@ -746,7 +746,7 @@ AC_TRY_RUN([
- #include <regex.h>
- regex_t x; regmatch_t m;
- int main() { return regcomp(&x,"pat.*",0) || regexec(&x,"pattern",1,&m,0); }
--], ac_cv_func_regcomp=yes, ac_cv_func_regcomp=no, AC_MSG_ERROR([Cannot test regcomp when cross compiling]))])
-+], ac_cv_func_regcomp=yes, ac_cv_func_regcomp=no, AC_MSG_WARN([Cannot test regcomp when cross compiling]))])
- AC_MSG_RESULT($ac_cv_func_regcomp)
- test $ac_cv_func_regcomp = yes && AC_DEFINE(HAVE_REGCOMP,1,[Define if regcomp exists and functions])
- dnl
-@@ -1608,7 +1608,7 @@ void foo2() __attribute__((destructor));
- void foo2() { unlink("conftest.2"); }
- int main () { return 0; }],
- [test -r conftest.1 || a=yes
--test -r conftest.2 || b=yes], , AC_MSG_ERROR(Cannot test for constructor/destructor support when cross compiling))
-+test -r conftest.2 || b=yes], , AC_MSG_WARN(Cannot test for constructor/destructor support when cross compiling))
- case $krb5_cv_host in
- *-*-aix4.*)
- 	# Under AIX 4.3.3, at least, shared library destructor functions
-diff --git a/configure.ac b/configure.ac
-index 234f4281..0e9f86dd 100644
---- a/configure.ac
-+++ b/configure.ac
-@@ -928,7 +928,7 @@ int main () {
- }],
-   ac_cv_printf_positional=yes,
-   ac_cv_printf_positional=no,
--  AC_MSG_ERROR([Cannot test for printf positional argument support when cross compiling]))])
-+  AC_MSG_WARN([Cannot test for printf positional argument support when cross compiling]))])
- # Nothing for autoconf.h for now.
- AC_MSG_RESULT($ac_cv_printf_positional)
- 
diff --git a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5_dont_create_run.patch b/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5_dont_create_run.patch
deleted file mode 100644
index d68e13b067..0000000000
--- a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/files/mit-krb5_dont_create_run.patch
+++ /dev/null
@@ -1,10 +0,0 @@
---- src/Makefile.in	2019-12-12 10:15:51.674552983 +0300
-+++ src/Makefile.in	2019-12-12 10:16:33.205543490 +0300
-@@ -71,7 +71,6 @@
- 		$(KRB5_AD_MODULE_DIR) \
- 		$(KRB5_LIBKRB5_MODULE_DIR) $(KRB5_TLS_MODULE_DIR) \
- 		@localstatedir@ @localstatedir@/krb5kdc \
--		@runstatedir@ @runstatedir@/krb5kdc \
- 		$(KRB5_INCSUBDIRS) $(datadir) $(EXAMPLEDIR) \
- 		$(PKGCONFIG_DIR)
- 
diff --git a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/mit-krb5-1.18.2-r4.ebuild b/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/mit-krb5-1.19.2.ebuild
similarity index 90%
rename from sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/mit-krb5-1.18.2-r4.ebuild
rename to sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/mit-krb5-1.19.2.ebuild
index efa92d1b1f..1ee2e7de82 100644
--- a/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/mit-krb5-1.18.2-r4.ebuild
+++ b/sdk_container/src/third_party/coreos-overlay/app-crypt/mit-krb5/mit-krb5-1.19.2.ebuild
@@ -3,7 +3,7 @@
 
 EAPI=7
 
-PYTHON_COMPAT=( python3_{6,7} )
+PYTHON_COMPAT=( python3_{7,8,9} )
 inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs
 
 MY_P="${P/mit-}"
@@ -14,7 +14,7 @@ SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz"
 
 LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )"
 SLOT="0"
-KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~s390 sparc x86"
+KEYWORDS="~alpha amd64 arm arm64 hppa ~ia64 ~mips ppc ppc64 ~riscv ~s390 sparc x86"
 IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd"
 
 # Test suite requires network access
@@ -31,9 +31,7 @@ DEPEND="
 	lmdb? ( dev-db/lmdb )
 	nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] )
 	openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] )
-	pkinit? (
-		>=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}]
-	)
+	pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] )
 	xinetd? ( sys-apps/xinetd )
 	"
 BDEPEND="
@@ -58,11 +56,8 @@ S=${WORKDIR}/${MY_P}/src
 PATCHES=(
 	"${FILESDIR}/${PN}-1.12_warn_cflags.patch"
 	"${FILESDIR}/${PN}-config_LDFLAGS-r1.patch"
-	"${FILESDIR}/${PN}_dont_create_run.patch"
-	"${FILESDIR}/CVE-2020-28196.patch"
+	"${FILESDIR}/${PN}_dont_create_rundir.patch"
 	"${FILESDIR}/${PN}-1.18.2-krb5-config.patch"
-	"${FILESDIR}/${PN}-1.18.2-autoconf-2.70.patch"
-	"${FILESDIR}/${PN}-warn-crossbuild.patch"
 )
 
 MULTILIB_CHOST_TOOLS=(
@@ -88,6 +83,7 @@ src_configure() {
 
 multilib_src_configure() {
 	ECONF_SOURCE=${S} \
+	AR="$(tc-getAR)" \
 	WARN_CFLAGS="set" \
 	econf \
 		$(use_with openldap ldap) \
@@ -104,9 +100,7 @@ multilib_src_configure() {
 		--enable-dns-for-realm \
 		--enable-kdc-lookaside-cache \
 		--with-system-verto \
-		--disable-rpath \
-		\
-		AR="$(tc-getAR)"
+		--disable-rpath
 }
 
 multilib_src_compile() {