Debian Long Term Support / LTS Security Information / 2023 / Security Information -- DLA-3311-1 heimdal

Debian Security Advisory

DLA-3311-1 heimdal -- LTS security update

Date Reported:

08 Feb 2023

Affected Packages:

heimdal

Vulnerable:

Yes

Security database references:

In the Debian bugtracking system: Bug 1030849.
In Mitre's CVE dictionary: CVE-2022-45142.

More information:

Helmut Grohne discovered a flaw in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos. The backports of fixes for CVE-2022-3437 accidentally inverted important memory comparisons in the arcfour-hmac-md5 and rc4-hmac integrity check handlers for gssapi, resulting in incorrect validation of message integrity codes.

For Debian 10 buster, this problem has been fixed in version 7.5.0+dfsg-3+deb10u2.

We recommend that you upgrade your heimdal packages.

For the detailed security status of heimdal please refer to its security tracker page at: https://security-tracker.debian.org/tracker/heimdal

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS