Debian Security Advisory
DLA-3311-1 heimdal -- LTS security update
- Date Reported:
- 08 Feb 2023
- Affected Packages:
- heimdal
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 1030849.
In Mitre's CVE dictionary: CVE-2022-45142. - More information:
-
Helmut Grohne discovered a flaw in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos. The backports of fixes for CVE-2022-3437 accidentally inverted important memory comparisons in the
arcfour-hmac-md5
andrc4-hmac
integrity check handlers for gssapi, resulting in incorrect validation of message integrity codes.For Debian 10 buster, this problem has been fixed in version 7.5.0+dfsg-3+deb10u2.
We recommend that you upgrade your heimdal packages.
For the detailed security status of heimdal please refer to its security tracker page at: https://security-tracker.debian.org/tracker/heimdal
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS