Mageia: 2022-0468 Moderate: Heimdal KDC Denial Of Service Advisory

Isaac Boukris reported that the Heimdal KDC before 7.7.1 does not apply delegation_not_allowed (aka not-delegated) user attributes for S4U2Self. Instead the forwardable flag is set even if the impersonated client has the not-delegated flag set. (CVE-2019-14870)
Joseph Sutton discovered that the Heimdal KDC before 7.7.1 does not check for missing missing sname in TGS-REQ (Ticket Granting Server Request) before before dereferencing. An authenticated user could use this flaw to crash the KDC. (CVE-2021-3671)
It was discovered that Heimdal is prone to a NULL dereference in acceptorswhen the initial SPNEGO token has no acceptable mechanisms, which may result in denial of service for a server application that uses the Simple and Protected GSSAPI Negotiation Mechanism (SPNEGO). (CVE-2021-44758)
Evgeny Legerov reported that the DES and Triple-DES decryption routines in the Heimdal GSSAPI library before 7.7.1 were prone to buffer overflow on malloc() allocated memory when presented with a ma...