CVE-2022-45142: High severity Heimdal Project Heimdal vulnerability
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/heimdalto a version that resolves this vulnerability.Fixed in 7.8.git20221117.28daf24+dfsg-2Fixed in 7.8.git20221117.28daf24+dfsg-9+deb13u1Fixed in 7.8.git20240113.1b4565a+dfsg-2 - Upgrade
Upgrade
alpine/heimdalto a version that resolves this vulnerability.Fixed in 7.7.1-r1 - Upgrade
Upgrade
alpine/heimdalto a version that resolves this vulnerability.Fixed in 7.7.1-r0 - Upgrade
Upgrade
alpine/heimdalto a version that resolves this vulnerability.Fixed in 7.8.0-r1 - Upgrade
Upgrade
alpine/heimdalto a version that resolves this vulnerability.Fixed in 7.8.0-r2 - Upgrade
Upgrade
debian/heimdalto a version that resolves this vulnerability.Fixed in 7.8.git20221117.28daf24+dfsg-1.1
Event History
Frequently Asked Questions
What is CVE-2022-45142?
CVE-2022-45142 is a vulnerability that affects Heimdal Project Heimdal versions 7.7.1 and 7.8.0, potentially other branches.
What is the severity of CVE-2022-45142?
The severity of CVE-2022-45142 is high, with a severity value of 7.5.
What is the description of CVE-2022-45142?
CVE-2022-45142 is a vulnerability in Heimdal Project Heimdal that involves a logic inversion in the backported patches for fixing CVE-2022-3437.
How does CVE-2022-45142 affect Heimdal Project Heimdal?
CVE-2022-45142 affects Heimdal Project Heimdal versions 7.7.1 and 7.8.0, potentially other branches.
Are there any references for CVE-2022-45142?
Yes, you can find references for CVE-2022-45142 at the following links: [Reference 1](https://security.gentoo.org/glsa/202310-06), [Reference 2](https://www.openwall.com/lists/oss-security/2023/02/08/1).