GNU bug report logs - #62760
[PATCH 0/3] Two serious vulnerabilities in Heimdal Kerberos

Previous Next

Full log

Message #17 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Leo Famulari <leo <at> famulari.name>
To: Felix Lechner via Guix-patches via <guix-patches <at> gnu.org>
Cc: Felix Lechner <felix.lechner <at> lease-up.com>, 62760 <at> debbugs.gnu.org
Subject: Re: [bug#62760] [PATCH 1/3] gnu: heimdal: Update to 7.8.0.
Date: Mon, 10 Apr 2023 19:05:35 -0400

On Mon, Apr 10, 2023 at 12:52:24PM -0700, Felix Lechner via Guix-patches via wrote:
> Fixes CVE-2022-44640 [1] "Heimdal KDC: invalid free in ASN.1 codec." The
> upstream release announcement calls it "a severe vulnerability, possibly a
> 10.0 on the Common Vulnerability Scoring System (CVSS) v3."
> 
> The upstream developers further "believe it should be possible to get an RCE
> [remote code execution] on a KDC, which means that credentials can be
> compromised that can be used to impersonate anyone in a realm or forest of
> realms." "While no zero-day exploit is known, such an exploit will likely be
> available soon after public disclosure." [2]
> 
> [1] https://nvd.nist.gov/vuln/detail/CVE-2022-44640
> [2] https://github.com/heimdal/heimdal/releases/tag/heimdal-7.8.0
> 
> * gnu/packages/kerberos.scm (heimdal): Update to 7.8.0.

Thanks for this!

> @@ -249,7 +250,8 @@ (define-public heimdal
>      (native-inputs (list e2fsprogs ;for 'compile_et'
>                           texinfo
>                           unzip ;for tests
> -                         perl))
> +                         perl
> +                         python))

Is this part intentional? It wasn't mentioned in the commit message.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.