Advisories ยป MGASA-2023-0098

Updated heimdal packages fix security vulnerability

Publication date: 18 Mar 2023
Modification date: 18 Mar 2023
Type: security
Affected Mageia releases : 8
CVE: CVE-2022-45142

Description

The fix for CVE-2022-3437 included changing memcmp to be constant time and
a workaround for a compiler bug by adding "!= 0" comparisons to the result
of memcmp. When these patches were backported a logic inversion sneaked in
causing the validation of message integrity codes in gssapi/arcfour to be
inverted. (CVE-2022-45142)
                

References

SRPMS

8/core