[Buildroot] [PATCH 1/1] package/heimdal: security bump to version 7.7.1

[Buildroot] [PATCH 1/1] package/heimdal: security bump to version 7.7.1

[Fabrice Fontaine]

This release fixes the following Security Vulnerabilities:

- CVE-2022-42898 PAC parse integer overflows
- CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and
  arcfour
- CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of
  array
- CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors
- CVE-2021-3671 A null pointer de-reference when handling missing sname
  in TGS-REQ
- CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec

  Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0
  on the Common Vulnerability Scoring System (CVSS) v3, as we believe
  it should be possible to get an RCE on a KDC, which means that
  credentials can be compromised that can be used to impersonate
  anyone in a realm or forest of realms.

  Heimdal's ASN.1 compiler generates code that allows specially
  crafted DER encodings of CHOICEs to invoke the wrong free function
  on the decoded structure upon decode error. This is known to impact
  the Heimdal KDC, leading to an invalid free() of an address partly
  or wholly under the control of the attacker, in turn leading to a
  potential remote code execution (RCE) vulnerability.

  This error affects the DER codec for all extensible CHOICE types
  used in Heimdal, though not all cases will be exploitable. We have
  not completed a thorough analysis of all the Heimdal components
  affected, thus the Kerberos client, the X.509 library, and other
  parts, may be affected as well.

  This bug has been in Heimdal's ASN.1 compiler since 2005, but it may
  only affect Heimdal 1.6 and up. It was first reported by Douglas
  Bagnall, though it had been found independently by the Heimdal
  maintainers via fuzzing a few weeks earlier.

  While no zero-day exploit is known, such an exploit will likely be
  available soon after public disclosure.

- CVE-2019-14870: Validate client attributes in protocol-transition

- CVE-2019-14870: Apply forwardable policy in protocol-transition
- CVE-2019-14870: Always lookup impersonate client in DB

Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
---
 package/heimdal/heimdal.hash | 4 ++--
 package/heimdal/heimdal.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/package/heimdal/heimdal.hash b/package/heimdal/heimdal.hash
index 005447a43b..cf822340da 100644
--- a/package/heimdal/heimdal.hash
+++ b/package/heimdal/heimdal.hash
@@ -1,5 +1,5 @@
 # From https://github.com/heimdal/heimdal/releases
-sha1  5dd16703be7255f66a4d65440f0c622aeeca60d9  heimdal-7.7.0.tar.gz
-sha256  f02d3314d634cc55eb9cf04a1eae0d96b293e45a1f837de9d894e800161b7d1b  heimdal-7.7.0.tar.gz
+sha1  a33fdc957f84ab13f39f164b04fe1deeaab3179e  heimdal-7.7.1.tar.gz
+sha256  117cb1ede7848db24cf27311c46f7f735a99f9c836c22e80aec92b91efe56644  heimdal-7.7.1.tar.gz
 # Locally computed
 sha256  0c4b07bf5b98f7a1d01f8e60722d6c6747ef052c2aa6d2043daf690d4e1b0a7f  LICENSE
diff --git a/package/heimdal/heimdal.mk b/package/heimdal/heimdal.mk
index a8d87531ec..21b6c0ccb3 100644
--- a/package/heimdal/heimdal.mk
+++ b/package/heimdal/heimdal.mk
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-HEIMDAL_VERSION = 7.7.0
+HEIMDAL_VERSION = 7.7.1
 HEIMDAL_SITE = https://github.com/heimdal/heimdal/releases/download/heimdal-$(HEIMDAL_VERSION)
 HOST_HEIMDAL_DEPENDENCIES = host-e2fsprogs host-ncurses host-pkgconf
 HEIMDAL_INSTALL_STAGING = YES
-- 
2.35.1

_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/heimdal: security bump to version 7.7.1

[Thomas Petazzoni via buildroot]

On Wed, 23 Nov 2022 23:24:01 +0100
Fabrice Fontaine <fontaine.fabrice@gmail.com> wrote:

> This release fixes the following Security Vulnerabilities:
> 
> - CVE-2022-42898 PAC parse integer overflows
> - CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and
>   arcfour
> - CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of
>   array
> - CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors
> - CVE-2021-3671 A null pointer de-reference when handling missing sname
>   in TGS-REQ
> - CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec
> 
>   Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0
>   on the Common Vulnerability Scoring System (CVSS) v3, as we believe
>   it should be possible to get an RCE on a KDC, which means that
>   credentials can be compromised that can be used to impersonate
>   anyone in a realm or forest of realms.
> 
>   Heimdal's ASN.1 compiler generates code that allows specially
>   crafted DER encodings of CHOICEs to invoke the wrong free function
>   on the decoded structure upon decode error. This is known to impact
>   the Heimdal KDC, leading to an invalid free() of an address partly
>   or wholly under the control of the attacker, in turn leading to a
>   potential remote code execution (RCE) vulnerability.
> 
>   This error affects the DER codec for all extensible CHOICE types
>   used in Heimdal, though not all cases will be exploitable. We have
>   not completed a thorough analysis of all the Heimdal components
>   affected, thus the Kerberos client, the X.509 library, and other
>   parts, may be affected as well.
> 
>   This bug has been in Heimdal's ASN.1 compiler since 2005, but it may
>   only affect Heimdal 1.6 and up. It was first reported by Douglas
>   Bagnall, though it had been found independently by the Heimdal
>   maintainers via fuzzing a few weeks earlier.
> 
>   While no zero-day exploit is known, such an exploit will likely be
>   available soon after public disclosure.
> 
> - CVE-2019-14870: Validate client attributes in protocol-transition
> 
> - CVE-2019-14870: Apply forwardable policy in protocol-transition
> - CVE-2019-14870: Always lookup impersonate client in DB
> 
> Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>
> ---
>  package/heimdal/heimdal.hash | 4 ++--
>  package/heimdal/heimdal.mk   | 2 +-
>  2 files changed, 3 insertions(+), 3 deletions(-)

Applied to master, thanks.

Thomas
-- 
Thomas Petazzoni, CTO, Bootlin
Embedded Linux and Kernel engineering
https://bootlin.com
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot

Re: [Buildroot] [PATCH 1/1] package/heimdal: security bump to version 7.7.1

[Peter Korsgaard]

>>>>> "Fabrice" == Fabrice Fontaine <fontaine.fabrice@gmail.com> writes:

 > This release fixes the following Security Vulnerabilities:
 > - CVE-2022-42898 PAC parse integer overflows
 > - CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and
 >   arcfour
 > - CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of
 >   array
 > - CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors
 > - CVE-2021-3671 A null pointer de-reference when handling missing sname
 >   in TGS-REQ
 > - CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec

 >   Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0
 >   on the Common Vulnerability Scoring System (CVSS) v3, as we believe
 >   it should be possible to get an RCE on a KDC, which means that
 >   credentials can be compromised that can be used to impersonate
 >   anyone in a realm or forest of realms.

 >   Heimdal's ASN.1 compiler generates code that allows specially
 >   crafted DER encodings of CHOICEs to invoke the wrong free function
 >   on the decoded structure upon decode error. This is known to impact
 >   the Heimdal KDC, leading to an invalid free() of an address partly
 >   or wholly under the control of the attacker, in turn leading to a
 >   potential remote code execution (RCE) vulnerability.

 >   This error affects the DER codec for all extensible CHOICE types
 >   used in Heimdal, though not all cases will be exploitable. We have
 >   not completed a thorough analysis of all the Heimdal components
 >   affected, thus the Kerberos client, the X.509 library, and other
 >   parts, may be affected as well.

 >   This bug has been in Heimdal's ASN.1 compiler since 2005, but it may
 >   only affect Heimdal 1.6 and up. It was first reported by Douglas
 >   Bagnall, though it had been found independently by the Heimdal
 >   maintainers via fuzzing a few weeks earlier.

 >   While no zero-day exploit is known, such an exploit will likely be
 >   available soon after public disclosure.

 > - CVE-2019-14870: Validate client attributes in protocol-transition

 > - CVE-2019-14870: Apply forwardable policy in protocol-transition
 > - CVE-2019-14870: Always lookup impersonate client in DB

 > Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com>

Committed to 2022.08.x and 2022.02.x, thanks.

-- 
Bye, Peter Korsgaard
_______________________________________________
buildroot mailing list
buildroot@buildroot.org
https://lists.buildroot.org/mailman/listinfo/buildroot