Heimdal 7.8 Repository: heimdal/heimdal · Tag: heimdal-7.8.0 · Commit: a6cf945 · Released by: nicowilliams This release fixes the following issues: CVE-2022-42898 PAC parse integer overflows CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring System (CVSS) v3, as we believe it should be possible to get an RCE on a KDC, which means that credentials can be compromised that can be used to impersonate anyone in a realm or forest of realms. Heimdal's ASN.1 compiler generates code that allows specially crafted DER encodings of CHOICEs to invoke the wrong free function on the decoded structure upon decode error. This is known to impact the Heimdal KDC, leading to an invalid free() of an address partly or wholly under the control of the attacker, in turn leading to a potential remote code execution (RCE) vulnerability. This error affects the DER codec for all extensible CHOICE types used in Heimdal, though not all cases will be exploitable. We have not completed a thorough analysis of all the Heimdal components affected, thus the Kerberos client, the X.509 library, and other parts, may be affected as well. This bug has been in Heimdal's ASN.1 compiler since 2005, but it may only affect Heimdal 1.6 and up. It was first reported by Douglas Bagnall, though it had been found independently by the Heimdal maintainers via fuzzing a few weeks earlier. While no zero-day exploit is known, such an exploit will likely be available soon after public disclosure. CVE-2019-14870: Validate client attributes in protocol-transition CVE-2019-14870: Apply forwardable policy in protocol-transition CVE-2019-14870: Always lookup impersonate client in DB Other changes: Bugs found by UBSAN (including the incorrect encoding of unconstrained INTEGER value -1). Errors found by the LLVM scan-build static analyzer. Errors found by the valgrind memory debugger. Work around GCC Bug 95189 (memcmp wrongly stripped like strcmp). Fix Unicode normalization read of 1 bytes past end of array. Correct ASN.1 OID typo for SHA-384 Fix a deadlock in in the MEMORY ccache type. TGS: strip forwardable and proxiable flags if the server is disallowed. CVE-2019-14870: Validate client attributes in protocol-transition CVE-2019-14870: Apply forwardable policy in protocol-transition CVE-2019-14870: Always lookup impersonate client in DB Incremental HDB propagation improvements Refactor send_diffs making it progressive Handle partial writes on non-blocking sockets Disable Nagle in iprop master and slave Use async I/O Don't send I_HAVE in response to AYT Do not recover log in kadm5_get_principal() Don't send diffs to slaves with not yet known version Don't stutter in send_diffs Optional backwards-compatible anon-pkinit behaviour
Heimdal 7.7.1 - Security Fix Release @nicowilliams nicowilliams released this 15 Nov 20:43 · 2160 commits to master since this release heimdal-7.7.1 78077c3 This release fixes the following Security Vulnerabilities: CVE-2022-42898 PAC parse integer overflows CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring System (CVSS) v3, as we believe it should be possible to get an RCE on a KDC, which means that credentials can be compromised that can be used to impersonate anyone in a realm or forest of realms. Heimdal's ASN.1 compiler generates code that allows specially crafted DER encodings of CHOICEs to invoke the wrong free function on the decoded structure upon decode error. This is known to impact the Heimdal KDC, leading to an invalid free() of an address partly or wholly under the control of the attacker, in turn leading to a potential remote code execution (RCE) vulnerability. This error affects the DER codec for all extensible CHOICE types used in Heimdal, though not all cases will be exploitable. We have not completed a thorough analysis of all the Heimdal components affected, thus the Kerberos client, the X.509 library, and other parts, may be affected as well. This bug has been in Heimdal's ASN.1 compiler since 2005, but it may only affect Heimdal 1.6 and up. It was first reported by Douglas Bagnall, though it had been found independently by the Heimdal maintainers via fuzzing a few weeks earlier. While no zero-day exploit is known, such an exploit will likely be available soon after public disclosure. CVE-2019-14870: Validate client attributes in protocol-transition CVE-2019-14870: Apply forwardable policy in protocol-transition CVE-2019-14870: Always lookup impersonate client in DB All of these fixes are also included in the Heimdal 7.8 release.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=d2b3d0f516d485cd8a9040f5d68f0943d810cdad commit d2b3d0f516d485cd8a9040f5d68f0943d810cdad Author: Eray Aslan <eras@gentoo.org> AuthorDate: 2022-11-15 22:57:45 +0000 Commit: Eray Aslan <eras@gentoo.org> CommitDate: 2022-11-15 22:57:45 +0000 app-crypt/heimdal: add 7.7.1 Bug: https://bugs.gentoo.org/881429 Signed-off-by: Eray Aslan <eras@gentoo.org> app-crypt/heimdal/Manifest | 1 + app-crypt/heimdal/heimdal-7.7.1.ebuild | 186 +++++++++++++++++++++++++++++++++ 2 files changed, 187 insertions(+)
*** Bug 878425 has been marked as a duplicate of this bug. ***
Note that there was already a bug filed for CVE-2022-3437. CVE-2019-14870 was previously addressed for Samba in bug 702928.
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=daa2d5a00ef05ee38ce089bb56cb658500b250e0 commit daa2d5a00ef05ee38ce089bb56cb658500b250e0 Author: Eray Aslan <eras@gentoo.org> AuthorDate: 2022-11-28 11:49:02 +0000 Commit: Eray Aslan <eras@gentoo.org> CommitDate: 2022-11-28 11:49:02 +0000 app-crypt/heimdal: drop 7.7.0-r5 Bug: https://bugs.gentoo.org/881429 Signed-off-by: Eray Aslan <eras@gentoo.org> app-crypt/heimdal/Manifest | 1 - .../heimdal/files/heimdal_fix-autoconf-2.70.patch | 29 ---- app-crypt/heimdal/heimdal-7.7.0-r5.ebuild | 188 --------------------- 3 files changed, 218 deletions(-)
CVE-2022-44640 (https://github.com/heimdal/heimdal/security/advisories/GHSA-88pm-hfmq-7vv4): Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1 codec used by the Key Distribution Center (KDC).
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/data/glsa.git/commit/?id=7bd41611164b352f0d17174c80887b0eae1e870f commit 7bd41611164b352f0d17174c80887b0eae1e870f Author: GLSAMaker <glsamaker@gentoo.org> AuthorDate: 2023-10-08 06:51:59 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2023-10-08 06:55:17 +0000 [ GLSA 202310-06 ] Heimdal: Multiple Vulnerabilities Bug: https://bugs.gentoo.org/881429 Bug: https://bugs.gentoo.org/893722 Signed-off-by: GLSAMaker <glsamaker@gentoo.org> Signed-off-by: Hans de Graaff <graaff@gentoo.org> glsa-202310-06.xml | 53 +++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 53 insertions(+)
