[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[bug#62760] [PATCH 0/3] Two serious vulnerabilities in Heimdal Kerberos

From: Felix Lechner
Subject: [bug#62760] [PATCH 0/3] Two serious vulnerabilities in Heimdal Kerberos
Date: Mon, 10 Apr 2023 12:50:06 -0700


This patch series addresses two serious vulnerabilities in Heimdal, which is
an implementation of the Kerberos protocol and therefore a security-relevant

First, the version being shipped currently in Guix suffers from "a severe
vulnerability, possibly a 10.0 on the Common Vulnerability Scoring System
(CVSS) v3." The upstream developers "believe it should be possible to get an
RCE [remote code execution] on a KDC, which means that credentials can be
compromised that can be used to impersonate anyone in a realm or forest of
realms." "While no zero-day exploit is known, such an exploit will likely be
available soon after public disclosure." [1]

Second, all recent upstream releases (but not the development branch) suffer
from a serious backporting error that NIST scored at a "7.5 HIGH". That issue
is being patched here. [2]

Finally, we enabled OpenLDAP support for the principals database (which is
different from using LDAP for user authorization) and modified the inputs to
be more in line with Debian packaging.

The packaging presented here passed some cursory testing for basic client and
server functionality locally, but that version did not include the patch for
CVE-2022-45142 because I did not know how to add it to my custom channel.

Kind regards
Felix Lechner


* * *

Felix Lechner (3):
  gnu: heimdal: Update to 7.8.0.
  gnu: heimdal: Patch for CVE-2022-45142.
  gnu: heimdal: Enable OpenLDAP support; converge inputs toward Debian

 gnu/packages/kerberos.scm                     | 25 +++++++---
 .../patches/heimdal-CVE-2022-45142.patch      | 49 +++++++++++++++++++
 2 files changed, 68 insertions(+), 6 deletions(-)
 create mode 100644 gnu/packages/patches/heimdal-CVE-2022-45142.patch

base-commit: b08cdfc6d363e9ca63118303b4628542c54a612d

reply via email to

[Prev in Thread] Current Thread [Next in Thread]