Improper Validation of Integrity Check Value Affecting heimdal package, versions <1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm4


Severity

Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.07% (33rd percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-UBUNTU1604-HEIMDAL-3315892
  • published8 Feb 2023
  • disclosed6 Mar 2023

Introduced: 8 Feb 2023

CVE-2022-45142  (opens in a new tab)
CWE-354  (opens in a new tab)

How to fix?

Upgrade Ubuntu:16.04 heimdal to version 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm4 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream heimdal package and not the heimdal package as distributed by Ubuntu. See How to fix? for Ubuntu:16.04 relevant fixed versions and status.

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.

CVSS Scores

version 3.1