[SECURITY] [DLA 3311-1] heimdal security update

2023-02-0812:28:56

lists.debian.org

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

7.1 High

AI Score

Confidence

High

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.001 Low

EPSS

Percentile

27.8%

JSON

Debian LTS Advisory DLA-3311-1 [email protected]
https://www.debian.org/lts/security/ Helmut Grohne
February 08, 2023 https://wiki.debian.org/LTS

Package : heimdal
Version : 7.5.0+dfsg-3+deb10u2
CVE ID : CVE-2022-45142
Debian Bug : #1030849

I discovered a flaw in Heimdal, an implementation of Kerberos 5 that
aims to be compatible with MIT Kerberos. The backports of fixes for
CVE-2022-3437 accidentally inverted important memory comparisons in the
arcfour-hmac-md5 and rc4-hmac integrity check handlers for gssapi,
resulting in incorrect validation of message integrity codes.

For Debian 10 buster, this problem has been fixed in version
7.5.0+dfsg-3+deb10u2.

We recommend that you upgrade your heimdal packages.

For the detailed security status of heimdal please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/heimdal

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian10alllibotp0-heimdal< 7.5.0+dfsg-3+deb10u2libotp0-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian10alllibgssapi3-heimdal< 7.5.0+dfsg-3+deb10u2libgssapi3-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian10alllibkafs0-heimdal< 7.5.0+dfsg-3+deb10u2libkafs0-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian10allheimdal< 7.5.0+dfsg-3+deb10u2heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian10alllibroken18-heimdal< 7.5.0+dfsg-3+deb10u2libroken18-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian10allheimdal-dev< 7.5.0+dfsg-3+deb10u2heimdal-dev_7.5.0+dfsg-3+deb10u2_all.deb
Debian10alllibkadm5clnt7-heimdal< 7.5.0+dfsg-3+deb10u2libkadm5clnt7-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian10alllibkrb5-26-heimdal< 7.5.0+dfsg-3+deb10u2libkrb5-26-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian10allheimdal-kcm< 7.5.0+dfsg-3+deb10u2heimdal-kcm_7.5.0+dfsg-3+deb10u2_all.deb
Debian10alllibheimbase1-heimdal< 7.5.0+dfsg-3+deb10u2libheimbase1-heimdal_7.5.0+dfsg-3+deb10u2_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	10	all	libotp0-heimdal	< 7.5.0+dfsg-3+deb10u2	libotp0-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	libgssapi3-heimdal	< 7.5.0+dfsg-3+deb10u2	libgssapi3-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	libkafs0-heimdal	< 7.5.0+dfsg-3+deb10u2	libkafs0-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	heimdal	< 7.5.0+dfsg-3+deb10u2	heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	libroken18-heimdal	< 7.5.0+dfsg-3+deb10u2	libroken18-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	heimdal-dev	< 7.5.0+dfsg-3+deb10u2	heimdal-dev_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	libkadm5clnt7-heimdal	< 7.5.0+dfsg-3+deb10u2	libkadm5clnt7-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	libkrb5-26-heimdal	< 7.5.0+dfsg-3+deb10u2	libkrb5-26-heimdal_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	heimdal-kcm	< 7.5.0+dfsg-3+deb10u2	heimdal-kcm_7.5.0+dfsg-3+deb10u2_all.deb
Debian	10	all	libheimbase1-heimdal	< 7.5.0+dfsg-3+deb10u2	libheimbase1-heimdal_7.5.0+dfsg-3+deb10u2_all.deb