heimdal/heimdal heimdal-7.8.0

Heimdal 7.8

on GitHub

This release includes both the Heimdal 7.7.1 Security Vulnerability fixes and non-Security bug fixes/improvements.

Security Vulnerabilities:

• CVE-2022-42898 PAC parse integer overflows

• CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour

• CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array

• CVE-2021-44758 A null pointer de-reference DoS in SPNEGO acceptors

• CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ

• CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec

  Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0
  on the Common Vulnerability Scoring System (CVSS) v3, as we believe
  it should be possible to get an RCE on a KDC, which means that
  credentials can be compromised that can be used to impersonate
  anyone in a realm or forest of realms.

  Heimdal's ASN.1 compiler generates code that allows specially
  crafted DER encodings of CHOICEs to invoke the wrong free function
  on the decoded structure upon decode error. This is known to impact
  the Heimdal KDC, leading to an invalid free() of an address partly
  or wholly under the control of the attacker, in turn leading to a
  potential remote code execution (RCE) vulnerability.

  This error affects the DER codec for all extensible CHOICE types
  used in Heimdal, though not all cases will be exploitable. We have
  not completed a thorough analysis of all the Heimdal components
  affected, thus the Kerberos client, the X.509 library, and other
  parts, may be affected as well.

  This bug has been in Heimdal's ASN.1 compiler since 2005, but it may
  only affect Heimdal 1.6 and up. It was first reported by Douglas
  Bagnall, though it had been found independently by the Heimdal
  maintainers via fuzzing a few weeks earlier.

  While no zero-day exploit is known, such an exploit will likely be
  available soon after public disclosure.

• CVE-2019-14870: Validate client attributes in protocol-transition

• CVE-2019-14870: Apply forwardable policy in protocol-transition

• CVE-2019-14870: Always lookup impersonate client in DB

Other changes:

• Bugs found by UBSAN (including the incorrect encoding of unconstrained
  INTEGER value -1).

• Errors found by the LLVM scan-build static analyzer.

• Errors found by the valgrind memory debugger.

• Work around GCC Bug 95189 (memcmp wrongly stripped like strcmp).

• Correct ASN.1 OID typo for SHA-384

• Fix a deadlock in in the MEMORY ccache type.

• TGS: strip forwardable and proxiable flags if the server is
  disallowed.

• CVE-2019-14870: Validate client attributes in protocol-transition

• CVE-2019-14870: Apply forwardable policy in protocol-transition

• CVE-2019-14870: Always lookup impersonate client in DB

• Incremental HDB propagation improvements

  • Refactor send_diffs making it progressive
  • Handle partial writes on non-blocking sockets
  • Disable Nagle in iprop master and slave
  • Use async I/O
  • Don't send I_HAVE in response to AYT
  • Do not recover log in kadm5_get_principal()
  • Don't send diffs to slaves with not yet known version
  • Don't stutter in send_diffs

• Optional backwards-compatible anon-pkinit behavior

Building from source

heimdal-7.8.0.tar.gz and its matching PGP signature file (heimdal-7.8.0.tar.gz.sig) should be downloaded in preference to the GitHub generated "source" archives. The heimdal-7.8.0.tar.gz archive contains the required build products necessary to "configure" and "make".

SHA1(heimdal-7.8.0.tar.gz)= 73d459b62a0a0b606b240ec4e541046e38a12d61
SHA256(heimdal-7.8.0.tar.gz)= fd87a207846fa650fd377219adc4b8a8193e55904d8a752c2c3715b4155d8d38

The GitHub generated "source" archives contain a raw copy of the repository contents for the "heimdal-7.8.0" tag.