ELSA-2023-12104

Опубликовано: 09 фев. 2023

Источник: oracle-oval

Платформа: Oracle Linux 6

Описание

ELSA-2023-12104: krb5 security update (IMPORTANT)

[1.10.3-65.0.1]

Fix integer overflows in PAC parsing (CVE-2022-42898) [Orabug: 34843511]

Обновленные пакеты

Oracle Linux 6

Oracle Linux x86_64

krb5-devel

1.10.3-65.0.1.el6

krb5-libs

1.10.3-65.0.1.el6

krb5-pkinit-openssl

1.10.3-65.0.1.el6

krb5-server

1.10.3-65.0.1.el6

krb5-server-ldap

1.10.3-65.0.1.el6

krb5-workstation

1.10.3-65.0.1.el6

libkadm5

1.10.3-65.0.1.el6

Oracle Linux i686

krb5-devel

1.10.3-65.0.1.el6

krb5-libs

1.10.3-65.0.1.el6

krb5-pkinit-openssl

1.10.3-65.0.1.el6

krb5-server

1.10.3-65.0.1.el6

krb5-server-ldap

1.10.3-65.0.1.el6

krb5-workstation

1.10.3-65.0.1.el6

libkadm5

1.10.3-65.0.1.el6

Связанные CVE

CVE-2022-42898

Ссылки на источники

Связанные уязвимости

CVE-2022-42898

CVSS3: 8.8

ubuntu

больше 2 лет назад

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."