Revision tags: heimdal-7-8-0
|
#
1.1.1.4 |
|
19-Jun-2023 |
christos |
Import heimdal-7.8.0 (previous was 7.7.0)
This release includes both the Heimdal 7.7.1 Security Vulnerability fixes and non-Security bug fixes/improvements.
Security Vulnerabilities: - CVE-2022-42898 PAC parse integer overflows - CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour - CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array - CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors - CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ - CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring System (CVSS) v3, as we believe it should be possible to get an RCE on a KDC, which means that credentials can be compromised that can be used to impersonate anyone in a realm or forest of realms.
Heimdal's ASN.1 compiler generates code that allows specially crafted DER encodings of CHOICEs to invoke the wrong free function on the decoded structure upon decode error. This is known to impact the Heimdal KDC, leading to an invalid free() of an address partly or wholly under the control of the attacker, in turn leading to a potential remote code execution (RCE) vulnerability.
This error affects the DER codec for all extensible CHOICE types used in Heimdal, though not all cases will be exploitable. We have not completed a thorough analysis of all the Heimdal components affected, thus the Kerberos client, the X.509 library, and other parts, may be affected as well.
This bug has been in Heimdal's ASN.1 compiler since 2005, but it may only affect Heimdal 1.6 and up. It was first reported by Douglas Bagnall, though it had been found independently by the Heimdal maintainers via fuzzing a few weeks earlier.
While no zero-day exploit is known, such an exploit will likely be available soon after public disclosure. - CVE-2019-14870: Validate client attributes in protocol-transition - CVE-2019-14870: Apply forwardable policy in protocol-transition - CVE-2019-14870: Always lookup impersonate client in DB
Other changes: - Bugs found by UBSAN (including the incorrect encoding of unconstrained INTEGER value -1). - Errors found by the LLVM scan-build static analyzer. - Errors found by the valgrind memory debugger. - Work around GCC Bug 95189 (memcmp wrongly stripped like strcmp). - Correct ASN.1 OID typo for SHA-384 - Fix a deadlock in in the MEMORY ccache type. - TGS: strip forwardable and proxiable flags if the server is disallowed. - CVE-2019-14870: Validate client attributes in protocol-transition - CVE-2019-14870: Apply forwardable policy in protocol-transition - CVE-2019-14870: Always lookup impersonate client in DB - Incremental HDB propagation improvements Refactor send_diffs making it progressive Handle partial writes on non-blocking sockets Disable Nagle in iprop master and slave Use async I/O Don't send I_HAVE in response to AYT Do not recover log in kadm5_get_principal() Don't send diffs to slaves with not yet known version Don't stutter in send_diffs - Optional backwards-compatible anon-pkinit behavior
|
Revision tags: netbsd-10-base netbsd-9-3-RELEASE cjep_sun2x-base1 cjep_sun2x-base cjep_staticlib_x-base1 netbsd-9-2-RELEASE cjep_staticlib_x-base netbsd-9-1-RELEASE phil-wifi-20200421 phil-wifi-20200411 is-mlppp-base phil-wifi-20200406 netbsd-8-2-RELEASE netbsd-9-0-RELEASE netbsd-9-0-RC2 heimdal-7-7-0 netbsd-9-0-RC1 phil-wifi-20191119 netbsd-9-base phil-wifi-20190609 netbsd-8-1-RELEASE netbsd-8-1-RC1 pgoyette-compat-merge-20190127 pgoyette-compat-20190127 pgoyette-compat-20190118 pgoyette-compat-1226 pgoyette-compat-1126 pgoyette-compat-1020 pgoyette-compat-0930 pgoyette-compat-0906 netbsd-7-2-RELEASE pgoyette-compat-0728 netbsd-8-0-RELEASE phil-wifi-base pgoyette-compat-0625 netbsd-8-0-RC2 pgoyette-compat-0521 pgoyette-compat-0502 pgoyette-compat-0422 netbsd-8-0-RC1 pgoyette-compat-0415 pgoyette-compat-0407 pgoyette-compat-0330 pgoyette-compat-0322 pgoyette-compat-0315 netbsd-7-1-2-RELEASE pgoyette-compat-base netbsd-7-1-1-RELEASE matt-nb8-mediatek-base perseant-stdc-iso10646-base netbsd-8-base prg-localcount2-base3 prg-localcount2-base2 prg-localcount2-base1 prg-localcount2-base pgoyette-localcount-20170426 bouyer-socketcan-base1 pgoyette-localcount-20170320 netbsd-7-1-RELEASE netbsd-7-1-RC2 head-20170128 netbsd-7-nhusb-base-20170116 bouyer-socketcan-base pgoyette-localcount-20170107 netbsd-7-1-RC1 pgoyette-localcount-20161104 netbsd-7-0-2-RELEASE localcount-20160914 netbsd-7-nhusb-base pgoyette-localcount-20160806 pgoyette-localcount-20160726 pgoyette-localcount-base netbsd-7-0-1-RELEASE netbsd-7-0-RELEASE netbsd-7-0-RC3 netbsd-7-0-RC2 netbsd-7-0-RC1 netbsd-7-base yamt-pagecache-base9 h5l-1-5-branch-20140422 tls-earlyentropy-base tls-maxphys-base
|
#
1.1.1.3 |
|
24-Apr-2014 |
pettai |
Import latest heimdal-1-5-branch from git
Ok'ed + reviewed by elric@
|
Revision tags: netbsd-6-0-6-RELEASE netbsd-6-1-5-RELEASE yamt-pagecache-tag8 netbsd-6-1-4-RELEASE netbsd-6-0-5-RELEASE riastradh-xf86-video-intel-2-7-1-pre-2-21-15 riastradh-drm2-base3 netbsd-6-1-3-RELEASE netbsd-6-0-4-RELEASE netbsd-6-1-2-RELEASE netbsd-6-0-3-RELEASE netbsd-6-1-1-RELEASE riastradh-drm2-base2 riastradh-drm2-base1 riastradh-drm2-base netbsd-6-0-2-RELEASE netbsd-6-1-RELEASE netbsd-6-1-RC4 netbsd-6-1-RC3 agc-symver-base netbsd-6-1-RC2 netbsd-6-1-RC1 yamt-pagecache-base8 netbsd-6-0-1-RELEASE yamt-pagecache-base7 matt-nb6-plus-nbase yamt-pagecache-base6 netbsd-6-0-RELEASE netbsd-6-0-RC2 matt-nb6-plus-base netbsd-6-0-RC1 yamt-pagecache-base5 yamt-pagecache-base4 netbsd-6-base yamt-pagecache-base3 yamt-pagecache-base2 yamt-pagecache-base cherry-xenmp-base head-20110412
|
#
1.1.1.2 |
|
14-Apr-2011 |
elric |
branches: 1.1.1.2.4; 1.1.1.2.6; 1.1.1.2.10; 1.1.1.2.12; 1.1.1.2.20; 1.1.1.2.22; Reimport Heimdal dist converted into NetBSD dist format. The prior import did not catch all of the $Id$ tags because many of them are unexpanded and the RE was only looking for expanded keywords.
|
#
1.1.1.1 |
|
13-Apr-2011 |
elric |
Import latest Heimdal from the head of their git repository into the new location for externally maintained software.
|
#
1.1 |
|
13-Apr-2011 |
elric |
branches: 1.1.1; Initial revision
|
#
1.1.1.3 |
|
24-Apr-2014 |
pettai |
Import latest heimdal-1-5-branch from git
Ok'ed + reviewed by elric@
|
#
1.1.1.2 |
|
14-Apr-2011 |
elric |
branches: 1.1.1.2.4; 1.1.1.2.10; 1.1.1.2.22; Reimport Heimdal dist converted into NetBSD dist format. The prior import did not catch all of the $Id$ tags because many of them are unexpanded and the RE was only looking for expanded keywords.
|
#
1.1.1.1 |
|
13-Apr-2011 |
elric |
Import latest Heimdal from the head of their git repository into the new location for externally maintained software.
|
#
1.1.1.2.22.1 |
|
10-Aug-2014 |
tls |
Rebase.
|
#
1.1.1.2.10.1 |
|
19-Aug-2014 |
tls |
Rebase to HEAD as of a few days ago.
|
#
1.1.1.2.4.1 |
|
22-May-2014 |
yamt |
sync with head.
for a reference, the tree before this commit was tagged as yamt-pagecache-tag8.
this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments")
|