MGASA-2023-0098 - Updated heimdal packages fix security vulnerability Publication date: 18 Mar 2023 URL: https://advisories.mageia.org/MGASA-2023-0098.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-45142 The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted. (CVE-2022-45142) References: - https://bugs.mageia.org/show_bug.cgi?id=31530 - https://www.openwall.com/lists/oss-security/2023/02/08/1 - https://www.debian.org/security/2023/dsa-5344 - https://ubuntu.com/security/notices/USN-5849-1 - https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45142 SRPMS: - 8/core/heimdal-7.7.1-1.3.mga8
Mageia 2023-0098: heimdal security update
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp
Summary
The fix for CVE-2022-3437 included changing memcmp to be constant time and
a workaround for a compiler bug by adding "!= 0" comparisons to the result
of memcmp. When these patches were backported a logic inversion sneaked in
causing the validation of message integrity codes in gssapi/arcfour to be
inverted. (CVE-2022-45142)
References
- https://bugs.mageia.org/show_bug.cgi?id=31530
- https://www.openwall.com/lists/oss-security/2023/02/08/1
- https://www.debian.org/security/2023/dsa-5344
- https://ubuntu.com/security/notices/USN-5849-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45142
Resolution
MGASA-2023-0098 - Updated heimdal packages fix security vulnerability
SRPMS
- 8/core/heimdal-7.7.1-1.3.mga8
Severity
Publication date: 18 Mar 2023
URL: https://advisories.mageia.org/MGASA-2023-0098.html
Type: security
CVE: CVE-2022-45142
News
HOWTOs
About Us
Powered By
