CVE-2022-45142: accidental logic inversion in signature verification in gsskrb5

Debian Bug report logs - #1030849
CVE-2022-45142: accidental logic inversion in signature verification in gsskrb5

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Helmut Grohne <helmut@subdivi.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: CVE-2022-45142: accidental logic inversion in signature verification in gsskrb5

Date: Wed, 8 Feb 2023 12:43:02 +0100

Source: heimdal
Version: 7.8.git20221117.28daf24+dfsg-1
Severity: grave
Tags: upstream
Forwarded: https://www.openwall.com/lists/oss-security/2023/02/08/1

Hi,

Debian's heimdal is also vulnerable to CVE-2022-45142. Refer to the
openwall publication for details. Note that this vulnerability only
applies to heimdal's maintenance branches and never affected its main
development branch. It can be fixed either by applying the patch or by
moving to the development branch.

Salvatore will be issuing a DSA today. I'll be taking care of older
releases.

Helmut

Send a report that this bug log contains spam.