Advisories » MGASA-2023-0098

Updated heimdal packages fix security vulnerability

Publication date: 18 Mar 2023
Modification date: 18 Mar 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-45142

Description

The fix for CVE-2022-3437 included changing memcmp to be constant time and
a workaround for a compiler bug by adding "!= 0" comparisons to the result
of memcmp. When these patches were backported a logic inversion sneaked in
causing the validation of message integrity codes in gssapi/arcfour to be
inverted. (CVE-2022-45142)
                

References

• https://bugs.mageia.org/show_bug.cgi?id=31530
• https://www.openwall.com/lists/oss-security/2023/02/08/1
• https://www.debian.org/security/2023/dsa-5344
• https://ubuntu.com/security/notices/USN-5849-1
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-45142

SRPMS

8/core

• heimdal-7.7.1-1.3.mga8