krb5: CVE-2017-15088: Buffer overflow in get_matching_data()

Debian Bug report logs - #871698
krb5: CVE-2017-15088: Buffer overflow in get_matching_data()

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: kpp <kraynopp@km.ru>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: krb5-pkinit: DN buffer too small

Date: Thu, 10 Aug 2017 21:30:40 +0300

Package: krb5-pkinit
Version: 1.15-1
Severity: normal

Dear Maintainer,

In file /krb5-1.15.1/src/plugins/preauth/pkinit/pkinit_crypto_openssl.h 
I have found constant:

#define DN_BUF_LEN  256

So, the size of DN is limited by 256 bytes. It is very small and can be 
easily overflowed, especially if DN contains utf8-encoded CN/O/OU.
In this case PKINIT failed with error 'stack smashing detected'.

Please, consider to increase DN_BUF_LEN or use dynamic memory allocation 
for DN buffer.


-- System Information:
Debian Release: 9.1
  APT prefers stable
  APT policy: (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 4.9.0-3-amd64 (SMP w/1 CPU core)
Locale: LANG=ru_RU.UTF-8, LC_CTYPE=ru_RU.UTF-8 (charmap=UTF-8), 
LANGUAGE=ru_RU.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages krb5-pkinit depends on:
ii  libc6            2.24-11+deb9u1
ii  libcomerr2       1.43.4-2
ii  libk5crypto3     1.15-1
ii  libkeyutils1     1.5.9-9
ii  libkrb5-3        1.15-1
ii  libkrb5support0  1.15-1
ii  libssl1.1        1.1.0f-3

krb5-pkinit recommends no packages.

Versions of packages krb5-pkinit suggests:
ii  opensc  0.16.0-3

-- no debconf information

Message #10 received at 871698@bugs.debian.org (full text, mbox, reply):

From: Benjamin Kaduk <kaduk@mit.edu>

To: 871698@bugs.debian.org

Cc: control@bugs.debian.org

Subject: upstream patch

Date: Thu, 26 Oct 2017 21:11:48 -0500

tags 871698 upstream pending
thanks

Upstream has committed a patch to use dynamic allocation to master at
https://github.com/krb5/krb5/pull/707 .
The backport is not entirely trivial, but we should be able to get
a version in (whether our own or upstream's) fairly soon.

-Ben

Message #17 received at 871698@bugs.debian.org (full text, mbox, reply):

From: Sam Hartman <hartmans@debian.org>

To: Benjamin Kaduk <kaduk@mit.edu>

Cc: 871698@bugs.debian.org, control@bugs.debian.org

Subject: Re: Bug#871698: upstream patch

Date: Fri, 27 Oct 2017 18:36:09 -0400

I think that until the upstream release we could just increase the
length and get a fair distance.

Message #22 received at 871698@bugs.debian.org (full text, mbox, reply):

From: Benjamin Kaduk <kaduk@mit.edu>

To: Sam Hartman <hartmans@debian.org>

Cc: 871698@bugs.debian.org

Subject: Re: Bug#871698: upstream patch

Date: Fri, 27 Oct 2017 20:25:04 -0500

I think upstream actually did the backport earlier today, already.

-Ben

Message #27 received at 871698-close@bugs.debian.org (full text, mbox, reply):

From: Benjamin Kaduk <kaduk@mit.edu>

To: 871698-close@bugs.debian.org

Subject: Bug#871698: fixed in krb5 1.15.2-2

Date: Sun, 29 Oct 2017 00:05:46 +0000

Source: krb5
Source-Version: 1.15.2-2

We believe that the bug you reported is fixed in the latest version of
krb5, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 871698@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Benjamin Kaduk <kaduk@mit.edu> (supplier of updated krb5 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Sat, 28 Oct 2017 18:09:28 -0500
Source: krb5
Binary: krb5-user krb5-kdc krb5-kdc-ldap krb5-admin-server krb5-kpropd krb5-multidev libkrb5-dev libkrb5-dbg krb5-pkinit krb5-otp krb5-k5tls krb5-doc libkrb5-3 libgssapi-krb5-2 libgssrpc4 libkadm5srv-mit11 libkadm5clnt-mit11 libk5crypto3 libkdb5-8 libkrb5support0 libkrad0 krb5-gss-samples krb5-locales libkrad-dev
Architecture: source amd64 all
Version: 1.15.2-2
Distribution: unstable
Urgency: medium
Maintainer: Sam Hartman <hartmans@debian.org>
Changed-By: Benjamin Kaduk <kaduk@mit.edu>
Description:
 krb5-admin-server - MIT Kerberos master server (kadmind)
 krb5-doc   - documentation for MIT Kerberos
 krb5-gss-samples - MIT Kerberos GSS Sample applications
 krb5-k5tls - TLS plugin for MIT Kerberos
 krb5-kdc   - MIT Kerberos key server (KDC)
 krb5-kdc-ldap - MIT Kerberos key server (KDC) LDAP plugin
 krb5-kpropd - MIT Kerberos key server (Slave KDC Support)
 krb5-locales - internationalization support for MIT Kerberos
 krb5-multidev - development files for MIT Kerberos without Heimdal conflict
 krb5-otp   - OTP plugin for MIT Kerberos
 krb5-pkinit - PKINIT plugin for MIT Kerberos
 krb5-user  - basic programs to authenticate using MIT Kerberos
 libgssapi-krb5-2 - MIT Kerberos runtime libraries - krb5 GSS-API Mechanism
 libgssrpc4 - MIT Kerberos runtime libraries - GSS enabled ONCRPC
 libk5crypto3 - MIT Kerberos runtime libraries - Crypto Library
 libkadm5clnt-mit11 - MIT Kerberos runtime libraries - Administration Clients
 libkadm5srv-mit11 - MIT Kerberos runtime libraries - KDC and Admin Server
 libkdb5-8  - MIT Kerberos runtime libraries - Kerberos database
 libkrad-dev - MIT Kerberos RADIUS Library Development
 libkrad0   - MIT Kerberos runtime libraries - RADIUS library
 libkrb5-3  - MIT Kerberos runtime libraries
 libkrb5-dbg - debugging files for MIT Kerberos
 libkrb5-dev - headers and development libraries for MIT Kerberos
 libkrb5support0 - MIT Kerberos runtime libraries - Support library
Closes: 871698
Changes:
 krb5 (1.15.2-2) unstable; urgency=medium
 .
   * Apply upstream patch removing a fixed-size buffer in PKINIT client code,
     Closes: #871698
Checksums-Sha1:
 8e3b2e7fafa3a0b0ec1bbe71ad8105fc49057859 3359 krb5_1.15.2-2.dsc
 1d20e17ced4ba35af8ee8a71e0cc650459d1d444 143632 krb5_1.15.2-2.debian.tar.xz
 64defff249fa4bce787ee15c08fb980637fdec03 185076 krb5-admin-server-dbgsym_1.15.2-2_amd64.deb
 f4ee2d0c074b00761742ca0f8289003e3593c4d7 119340 krb5-admin-server_1.15.2-2_amd64.deb
 b1c6728b6a53ee4fb22b19dc2b3f0a20635462ec 2269996 krb5-doc_1.15.2-2_all.deb
 2ee632428f4dbd5988a7427d8c92115562648e71 40336 krb5-gss-samples-dbgsym_1.15.2-2_amd64.deb
 57ee49bc028a060c8f84129c4fe2c47ba278af0b 60516 krb5-gss-samples_1.15.2-2_amd64.deb
 e87aec5157131ccbf24da708aa51d4c9e4cde795 21084 krb5-k5tls-dbgsym_1.15.2-2_amd64.deb
 4341c5e5a253cbe7d9081419078e94f306e5cb2f 50560 krb5-k5tls_1.15.2-2_amd64.deb
 14c5bc932f58eaa87b3f20de0ff663dace71a70e 473112 krb5-kdc-dbgsym_1.15.2-2_amd64.deb
 003079ae484177f33d6ed95552bd0df083cafc37 257008 krb5-kdc-ldap-dbgsym_1.15.2-2_amd64.deb
 5171fc665be9105047638ee07791b114d6eeafc7 118900 krb5-kdc-ldap_1.15.2-2_amd64.deb
 c2153ca3f30ccd21ea916a1c0f0fafde13105dee 208276 krb5-kdc_1.15.2-2_amd64.deb
 fbbf6a879c6676f3cde9c768a05838df7d28b4fb 42280 krb5-kpropd-dbgsym_1.15.2-2_amd64.deb
 fdedf19e838836b64b5881f8dd4567673580e30e 62940 krb5-kpropd_1.15.2-2_amd64.deb
 2b40af8c7947f13c6de019bc256118a8d56e8183 94432 krb5-locales_1.15.2-2_all.deb
 e18fc5cb1dac61d229c609117f7d37d0d9c01a29 151244 krb5-multidev_1.15.2-2_amd64.deb
 1635d46cfe07caad9613f026841167ccc1f0bf5d 28044 krb5-otp-dbgsym_1.15.2-2_amd64.deb
 5ca2f1be5f670001c65e6835afea2e73facd7709 51800 krb5-otp_1.15.2-2_amd64.deb
 be0b9b0d8283381bc0bff3d8ad84923902f9e588 153988 krb5-pkinit-dbgsym_1.15.2-2_amd64.deb
 3b24c33791d8e2473c42ebae28ba00de8dd00002 87644 krb5-pkinit_1.15.2-2_amd64.deb
 1f7c775fd557be1c41e5eca9ec2ede2c307747cd 197032 krb5-user-dbgsym_1.15.2-2_amd64.deb
 5c73a03eb191cc24bebbceb27a167fd9e62ceecb 148800 krb5-user_1.15.2-2_amd64.deb
 c1ae75b3f388f574bea0465205d3027497a909ee 18950 krb5_1.15.2-2_amd64.buildinfo
 4f47f706eaffefd1f05ff6aff97d202d88e47b92 155864 libgssapi-krb5-2_1.15.2-2_amd64.deb
 f4d0591c60948834ef8e811b4d1789ac77de5203 89676 libgssrpc4_1.15.2-2_amd64.deb
 47d7c9dcd0c7a08013864ce82160e81650d1d5d5 120448 libk5crypto3_1.15.2-2_amd64.deb
 57563cc350b065ab6a5393e1e5356320face0c37 73120 libkadm5clnt-mit11_1.15.2-2_amd64.deb
 88cf498fcb144a9a00c111550b25ac6330083e32 87676 libkadm5srv-mit11_1.15.2-2_amd64.deb
 65fd679a92a38119dad062b900798069eb6aad50 72184 libkdb5-8_1.15.2-2_amd64.deb
 cbfcb2f72a1fe72d1f3e2e59708c79a0bf9448d2 46972 libkrad-dev_1.15.2-2_amd64.deb
 43da05700b4abc6f44a4ca40ecb1307e2694859c 56268 libkrad0_1.15.2-2_amd64.deb
 c3e10a1fc98a46aa0b16e03c609123cef9fed790 313564 libkrb5-3_1.15.2-2_amd64.deb
 fe0d2deb41f86cbac1591d6fe0dac7c170177ac8 2531600 libkrb5-dbg_1.15.2-2_amd64.deb
 e2d898da61e3633c39ba4e9d474f9f3a4fe12363 46428 libkrb5-dev_1.15.2-2_amd64.deb
 42b11720624a5ed149c8ad8e4c0bdf968e96a752 62812 libkrb5support0_1.15.2-2_amd64.deb
Checksums-Sha256:
 a2eef83c02667ef7d70d2a9f010eefa08a8f0a60160bee32c325c90f106348a1 3359 krb5_1.15.2-2.dsc
 aab7c3c58e6851e143c740ecf4bcd84654edaa938db81f2df1667bff978ac5be 143632 krb5_1.15.2-2.debian.tar.xz
 642c15fa9a8b98ef5a65d21df027f291b3d2c3b5300d12b442b38325c0cff4c2 185076 krb5-admin-server-dbgsym_1.15.2-2_amd64.deb
 8853e46466dea6161859b78c826c98e88855c9fbe57f6787d45b7d483b12a222 119340 krb5-admin-server_1.15.2-2_amd64.deb
 7461818890b58ec22041f88172289924d49edf582a16934aeec1a3a0a0800a0d 2269996 krb5-doc_1.15.2-2_all.deb
 af077f2a1ca4e6cf23d3f9f506c04efa9b1ad999eb395b1111f917e596803152 40336 krb5-gss-samples-dbgsym_1.15.2-2_amd64.deb
 a4e05f947ee54424df3bb732e6e3ba31dace09d31d95528129dc092b22c33742 60516 krb5-gss-samples_1.15.2-2_amd64.deb
 f40e48acb936f6ebad512eea5b45a747abe501c113b0b0315a2a4c7ef4140c90 21084 krb5-k5tls-dbgsym_1.15.2-2_amd64.deb
 44b62b7fbb4db88a7156785731b0c5b6dca3ec64b11e0bf0544d0534ea644c02 50560 krb5-k5tls_1.15.2-2_amd64.deb
 b650fe9e7501212f80735cee7381f7588aacc31faf59ff80322a9d5f2bc263f4 473112 krb5-kdc-dbgsym_1.15.2-2_amd64.deb
 73b9b73843e6cc5557f925e40e46612c61388d845bc4e30601f5da467cae4904 257008 krb5-kdc-ldap-dbgsym_1.15.2-2_amd64.deb
 cbe83a083d7c0aa1d8c235be99cb267eb9310190cdadccc3dd7777365f240f2e 118900 krb5-kdc-ldap_1.15.2-2_amd64.deb
 56442d6a2a6baf64d9b67f72c1df6f05c3c4c28611a2b69206c3416d1f4ac596 208276 krb5-kdc_1.15.2-2_amd64.deb
 efce4fbcddc3cc595752cc46fbc3451659dd0fcdf15805005700d7539134f4f2 42280 krb5-kpropd-dbgsym_1.15.2-2_amd64.deb
 56793b4b160f93d41c70f4377f742d168a84d881e16136fbffd3ddb665d2b796 62940 krb5-kpropd_1.15.2-2_amd64.deb
 930bfb4175913cf79cbfdf118e37e190a58c0151c37946f47eac6ca0e3ad6aa1 94432 krb5-locales_1.15.2-2_all.deb
 fed58c11efdcf907a915e28a8f4eec90c5ac6ca24f1c01c0b1aa78029eb281aa 151244 krb5-multidev_1.15.2-2_amd64.deb
 5628c8254681580c8258fc67c616056d43babec205ed8b96b2afc5ed7e6ddc63 28044 krb5-otp-dbgsym_1.15.2-2_amd64.deb
 8fa265fb488e8760dc00888052af27ba97905137c7be63d1b94854e2ad85f03e 51800 krb5-otp_1.15.2-2_amd64.deb
 7e35aad87f684cc1f86545b34da7684ed40ea535e0a7048f6df64fa068f79ca6 153988 krb5-pkinit-dbgsym_1.15.2-2_amd64.deb
 fb2f8a1b601073ae57c5656b13aef72aaffbfd86607414985053d43a18ab6b80 87644 krb5-pkinit_1.15.2-2_amd64.deb
 38771ca08fdff78599d2f04a6ca272a021c0cdfb1d27085f89b6e87e2e0bb93f 197032 krb5-user-dbgsym_1.15.2-2_amd64.deb
 7b4f1beaf20d8ef2e383dc868e2647af75ce1599672ff603625b2d864f171319 148800 krb5-user_1.15.2-2_amd64.deb
 87b9584c76152cfc450d295aa577d14c5811998f412f3da559307cfa820e439f 18950 krb5_1.15.2-2_amd64.buildinfo
 0e4eb44c1ab2d0c455288a72e8608fee938d7a8c0e800eb9646f4acc98f43198 155864 libgssapi-krb5-2_1.15.2-2_amd64.deb
 f895ab839a530f47a84748cab9f4e68283b60309a098b8c766f54f06e38fe102 89676 libgssrpc4_1.15.2-2_amd64.deb
 7fb809f841b3f770e7d9db2d162781426b4f7bf48d4a10e38ad251aa325ee8a1 120448 libk5crypto3_1.15.2-2_amd64.deb
 ebd3bf5dfbd95b507881bbdafbb85c7aa6395a7f66015156b48109432a8ca2af 73120 libkadm5clnt-mit11_1.15.2-2_amd64.deb
 d392939a54258aed372e5707b2a54276aee9afd0014d832f0435c1622535f612 87676 libkadm5srv-mit11_1.15.2-2_amd64.deb
 6139accd37a989036646b4bf8787aafe45cbf57f4d8cf6a07a775502d705f764 72184 libkdb5-8_1.15.2-2_amd64.deb
 02bdd765f871297e9e8dde38f8f359a446c559447512852472e7f53c5be5c6cd 46972 libkrad-dev_1.15.2-2_amd64.deb
 8dd4dd787bb579ed7e132fe57ce667cc8a8296efcf2b3b86e84443b01a509232 56268 libkrad0_1.15.2-2_amd64.deb
 60cf5b669bac54b7b9db0dec9825b951d09e6b231a73ae10353f4bb0a23cd422 313564 libkrb5-3_1.15.2-2_amd64.deb
 93ef411d187d9db3e7c4919d7f89a2635938f168014292f90a6fd3d6397c7f0b 2531600 libkrb5-dbg_1.15.2-2_amd64.deb
 35ed1fa60d0cb19bb23f131513a7747fe517ad6c4c4c3683a56d8ab3d416eef6 46428 libkrb5-dev_1.15.2-2_amd64.deb
 a396638768e3cc125b3413f2cbdc7112abe76f4a9f4a79e84c965c34d1f06744 62812 libkrb5support0_1.15.2-2_amd64.deb
Files:
 1e15a5bf65d25d08cb8746dec34e4411 3359 net optional krb5_1.15.2-2.dsc
 14ac3302bbab841cb6fd6f969c6ddc15 143632 net optional krb5_1.15.2-2.debian.tar.xz
 7f54c566387a19cf32ecea2017282494 185076 debug optional krb5-admin-server-dbgsym_1.15.2-2_amd64.deb
 d10fe99c65f857e4b1a5f8f28bcb4803 119340 net optional krb5-admin-server_1.15.2-2_amd64.deb
 5bd9ab71bed57fa8a7247ea93d213ae9 2269996 doc optional krb5-doc_1.15.2-2_all.deb
 f09afa840cb3ab7c89623f6a5d26aaa9 40336 debug optional krb5-gss-samples-dbgsym_1.15.2-2_amd64.deb
 78b096d0651a71efe2f18d02a2ade465 60516 net optional krb5-gss-samples_1.15.2-2_amd64.deb
 90c9ec23d6b700acf5b61291ddd21652 21084 debug optional krb5-k5tls-dbgsym_1.15.2-2_amd64.deb
 009ed722cc074be45cd042783d6e4cf2 50560 net optional krb5-k5tls_1.15.2-2_amd64.deb
 41a5a56b22d50f62bef9a879ede6cc9c 473112 debug optional krb5-kdc-dbgsym_1.15.2-2_amd64.deb
 29defd99eea68389243acc36e5ef529d 257008 debug optional krb5-kdc-ldap-dbgsym_1.15.2-2_amd64.deb
 ca223ab741177a27158c278f76cd8a4c 118900 net optional krb5-kdc-ldap_1.15.2-2_amd64.deb
 88811cc410702277516b08942c3070c6 208276 net optional krb5-kdc_1.15.2-2_amd64.deb
 286a08ccae6818d6def3c716d1ebd2f5 42280 debug optional krb5-kpropd-dbgsym_1.15.2-2_amd64.deb
 4bf0c62630a0b599ddacd243478f4f87 62940 net optional krb5-kpropd_1.15.2-2_amd64.deb
 5dec0b9d4ac6930fa4f286522de9bd72 94432 localization optional krb5-locales_1.15.2-2_all.deb
 58612bcb764cec11d32175032cc8e302 151244 libdevel optional krb5-multidev_1.15.2-2_amd64.deb
 06f03b8b03200f13d200a0b0cd14550b 28044 debug optional krb5-otp-dbgsym_1.15.2-2_amd64.deb
 31027d87a881883c0cff4a3019a94420 51800 net optional krb5-otp_1.15.2-2_amd64.deb
 c48e94622d7074530b4000c06390ce34 153988 debug optional krb5-pkinit-dbgsym_1.15.2-2_amd64.deb
 4306e32396bff967fe20fb7f59279999 87644 net optional krb5-pkinit_1.15.2-2_amd64.deb
 5ec3c89ba057451c893376e9d6b4c22d 197032 debug optional krb5-user-dbgsym_1.15.2-2_amd64.deb
 26e11daa47126a2b8f53149bce51ef63 148800 net optional krb5-user_1.15.2-2_amd64.deb
 b2cebf4dd5bdd66b58db8f74bc3c989d 18950 net optional krb5_1.15.2-2_amd64.buildinfo
 e24362daa7d24e9516c9d2e6f00ea142 155864 libs optional libgssapi-krb5-2_1.15.2-2_amd64.deb
 49a2e58ba871b429526df5a040501eb6 89676 libs optional libgssrpc4_1.15.2-2_amd64.deb
 3568eb859ec2513544f31778d5b87545 120448 libs optional libk5crypto3_1.15.2-2_amd64.deb
 b54113f001fee8591814135625b1c89f 73120 libs optional libkadm5clnt-mit11_1.15.2-2_amd64.deb
 5aaa0c1b70bbae17ae96649da6f16072 87676 libs optional libkadm5srv-mit11_1.15.2-2_amd64.deb
 fc727b220d70797163f60cb9e235f1a6 72184 libs optional libkdb5-8_1.15.2-2_amd64.deb
 1d898ce79d731d3c6e5f4c8f0324a79d 46972 libdevel optional libkrad-dev_1.15.2-2_amd64.deb
 e8ebc542bbe494d9225c4cf892b58950 56268 libs optional libkrad0_1.15.2-2_amd64.deb
 abac34e9f8124d324a7254ae27f4f3f4 313564 libs optional libkrb5-3_1.15.2-2_amd64.deb
 7b6b30c44f842b6ada26cbe1125bfe7c 2531600 debug optional libkrb5-dbg_1.15.2-2_amd64.deb
 b9af259151c787d5d332e24a751088cd 46428 libdevel optional libkrb5-dev_1.15.2-2_amd64.deb
 ca2620f9ceaa4e56ed1d1dae5565badf 62812 libs optional libkrb5support0_1.15.2-2_amd64.deb

-----BEGIN PGP SIGNATURE-----

iQHGBAEBCgAsFiEE2WGV4E2ARf9BYP0XKNmm82TrdRIFAln1FUMOHGthZHVrQG1p
dC5lZHUACgkQKNmm82TrdRJvwgwfdafz8ajyFxSnwUgKEqvofJn/v7WiAROG1eLI
2k0+hTnAkpHLfwCHC8R9z9cAxfTflCBqSUwKUthgSu8wxhEnlkGEQNNVbTeLJzk6
SW2gapcyDUV2CA7zpWDYoC9gHtWzMelr6CdTUTMXh7+xi0YG5+2eTlu4MSBO0Gx0
JcuPuSVTU5NavUFZu9EGakWYKZSPFrL40E2chhz2vDOSUkhDYC6sVQo+UVsVuqOE
+LcLnVR92kWs1Xc5uasB7Z1mDDJZFQCjk5RMYLuoaZNyjkQ5BQyHaYUDcZp0aeyf
QWd6hSImA4g9TEXG3uzOQaAwKaKAU7JerrkSyQjBFD+YRgXfqYcyfnfKbr4jBuuq
GkaaA++S4XzPiipOGa4JQ7QX6mP34ByuvqsZMXWy2ts59rAQrk0ZUHpvBgd3psn7
pYZSkIzEVE7GpQxUuTk0Uw+htdUOR5Bz8PUufybv3yTI+n9MnWdMxSKnzMchkgXn
GCpiDRsgc5tPAdH3gXfIJFP8l1KeDBAzoQ==
=ABfY
-----END PGP SIGNATURE-----

Message #38 received at 871698@bugs.debian.org (full text, mbox, reply):

From: Salvatore Bonaccorso <carnil@debian.org>

To: Benjamin Kaduk <kaduk@mit.edu>, 871698@bugs.debian.org

Cc: Sam Hartman <hartmans@debian.org>, Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#871698: upstream patch

Date: Sun, 29 Oct 2017 13:02:56 +0100

Hi

On Fri, Oct 27, 2017 at 08:25:04PM -0500, Benjamin Kaduk wrote:
> I think upstream actually did the backport earlier today, already.

I retitled the bug (Red Hat has assigned a CVE for the issue
(https://bugzilla.redhat.com/show_bug.cgi?id=1504045) (and added tag
security).

Regards,
Salvatore

Message #43 received at 871698@bugs.debian.org (full text, mbox, reply):

From: Benjamin Kaduk <kaduk@mit.edu>

To: Salvatore Bonaccorso <carnil@debian.org>

Cc: 871698@bugs.debian.org, Sam Hartman <hartmans@debian.org>, Moritz Muehlenhoff <jmm@debian.org>

Subject: Re: Bug#871698: upstream patch

Date: Sun, 29 Oct 2017 07:26:22 -0500

On Sun, Oct 29, 2017 at 01:02:56PM +0100, Salvatore Bonaccorso wrote:
> Hi
> 
> On Fri, Oct 27, 2017 at 08:25:04PM -0500, Benjamin Kaduk wrote:
> > I think upstream actually did the backport earlier today, already.
> 
> I retitled the bug (Red Hat has assigned a CVE for the issue
> (https://bugzilla.redhat.com/show_bug.cgi?id=1504045) (and added tag
> security).

Red Hat uses this code in their KDC, but for upstream and Debian it's
only used in the kinit(1) client, with a user-specified input certificate,
so upstream (and I) believe that no CVE is needed for our usage.

-Ben

Send a report that this bug log contains spam.