Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 809845 (CVE-2021-37750) - <app-crypt/mit-krb5-1.19.2-r2: NULL pointer dereference (CVE-2021-37750)
Summary: <app-crypt/mit-krb5-1.19.2-r2: NULL pointer dereference (CVE-2021-37750)
Status: RESOLVED FIXED
Alias: CVE-2021-37750
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL: https://github.com/krb5/krb5/commit/d...
Whiteboard: B3 [glsa+]
Keywords:
Depends on: 830634
Blocks:
  Show dependency tree
 
Reported: 2021-08-23 18:32 UTC by John Helmert III
Modified: 2024-05-05 07:15 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-08-23 18:32:40 UTC 
CVE-2021-37750:

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.


Doesn't seem like the commit has made it into a release yet?
Comment 1 Larry the Git Cow gentoo-dev 2022-01-05 09:57:03 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=16e1279e1a0b87ab89031972ea5b9f5136a67e76

commit 16e1279e1a0b87ab89031972ea5b9f5136a67e76
Author:     Eray Aslan <eras@gentoo.org>
AuthorDate: 2022-01-05 09:56:43 +0000
Commit:     Eray Aslan <eras@gentoo.org>
CommitDate: 2022-01-05 09:56:43 +0000

    app-crypt/mit-krb5: security bump
    
    Bug: https://bugs.gentoo.org/809845
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Eray Aslan <eras@gentoo.org>

 .../mit-krb5/files/mit-krb5-CVE-2021-37750.patch   |  43 ++++++
 app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild       | 165 +++++++++++++++++++++
 2 files changed, 208 insertions(+)
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-01-10 23:31:44 UTC 
Please cleanup
Comment 3 Larry the Git Cow gentoo-dev 2022-01-11 13:24:45 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=7c51ee27df2fb1d6584a6aeb1623d59af7cd8cd6

commit 7c51ee27df2fb1d6584a6aeb1623d59af7cd8cd6
Author:     Eray Aslan <eras@gentoo.org>
AuthorDate: 2022-01-11 13:24:23 +0000
Commit:     Eray Aslan <eras@gentoo.org>
CommitDate: 2022-01-11 13:24:23 +0000

    app-crypt/mit-krb5: cleanup
    
    Bug: https://bugs.gentoo.org/809845
    Package-Manager: Portage-3.0.30, Repoman-3.0.3
    Signed-off-by: Eray Aslan <eras@gentoo.org>

 app-crypt/mit-krb5/mit-krb5-1.19.2-r1.ebuild | 164 ---------------------------
 1 file changed, 164 deletions(-)
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-01-11 20:39:42 UTC 
Thanks!
Comment 5 Larry the Git Cow gentoo-dev 2024-05-05 07:13:54 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=573380a79676407a84c4bd5cfca7805936336c8a

commit 573380a79676407a84c4bd5cfca7805936336c8a
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2024-05-05 07:13:18 +0000
Commit:     Hans de Graaff <graaff@gentoo.org>
CommitDate: 2024-05-05 07:13:49 +0000

    [ GLSA 202405-11 ] MIT krb5: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/803434
    Bug: https://bugs.gentoo.org/809845
    Bug: https://bugs.gentoo.org/879875
    Bug: https://bugs.gentoo.org/917464
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: Hans de Graaff <graaff@gentoo.org>

 glsa-202405-11.xml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)