------------------------------------------------------------------------- Debian LTS Advisory DLA-3311-1 debian-lts@lists.debian.org https://www.debian.org/lts/security/ Helmut Grohne February 08, 2023 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : heimdal Version : 7.5.0+dfsg-3+deb10u2 CVE ID : CVE-2022-45142 Debian Bug : #1030849 I discovered a flaw in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos. The backports of fixes for CVE-2022-3437 accidentally inverted important memory comparisons in the arcfour-hmac-md5 and rc4-hmac integrity check handlers for gssapi, resulting in incorrect validation of message integrity codes. For Debian 10 buster, this problem has been fixed in version 7.5.0+dfsg-3+deb10u2. We recommend that you upgrade your heimdal packages. For the detailed security status of heimdal please refer to its security tracker page at: https://security-tracker.debian.org/tracker/heimdal Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature