ELSA-2022-8638

Опубликовано: 28 нояб. 2022

Источник: oracle-oval

Платформа: Oracle Linux 8

Описание

ELSA-2022-8638: krb5 security update (IMPORTANT)

[1.18.2-22.0.1]

Fixed race condition in krb5_set_password() [Orabug: 33609767]

[1.]

Fix integer overflows in PAC parsing (CVE-2022-42898)
Resolves: rhbz#2140967

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

krb5-devel

1.18.2-22.0.1.el8_7

krb5-libs

1.18.2-22.0.1.el8_7

krb5-pkinit

1.18.2-22.0.1.el8_7

krb5-server

1.18.2-22.0.1.el8_7

krb5-server-ldap

1.18.2-22.0.1.el8_7

krb5-workstation

1.18.2-22.0.1.el8_7

libkadm5

1.18.2-22.0.1.el8_7

Oracle Linux x86_64

krb5-devel

1.18.2-22.0.1.el8_7

krb5-libs

1.18.2-22.0.1.el8_7

krb5-pkinit

1.18.2-22.0.1.el8_7

krb5-server

1.18.2-22.0.1.el8_7

krb5-server-ldap

1.18.2-22.0.1.el8_7

krb5-workstation

1.18.2-22.0.1.el8_7

libkadm5

1.18.2-22.0.1.el8_7

Связанные CVE

CVE-2022-42898

Ссылки на источники

Связанные уязвимости

CVE-2022-42898

CVSS3: 8.8

ubuntu

больше 2 лет назад

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."