PT-2022-6537 · Heimdal+4 · Heimdal+4

Helmut Grohne · Published 2022-12-09 · Updated 2025-01-28 · CVE-2022-45142

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions heimdal versions 7.7.1 through 7.8.0

Description The issue is related to the implementation of the Kerberos5 protocol in heimdal, specifically concerning incorrect validation of message integrity codes. This can allow a remote attacker to cause a logical inversion, resulting in the validation of message integrity codes in gssapi/arcfour to be inverted.

Recommendations For heimdal versions 7.7.1 through 7.8.0, consider applying the original fix for the issue without the logic inversion, which includes changing memcmp to be constant time and adding "!= 0" comparisons to the result of memcmp. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-354

Related Identifiers

AZL-25604

AZL-34797

BDU:2023-02156

CVE-2022-45142

DLA-3311-1

DSA-5344-1

MGASA-2023-0098

OPENSUSE-SU-2024:12846-1

ROSA-SA-2025-2638

USN-5849-1

Affected Products

Astra Linux

Linuxmint

Red Os

Ubuntu

Heimdal

References · 29

• https://osv.dev/vulnerability/AZL-34797 · Vendor Advisory
• https://ubuntu.com/security/CVE-2022-45142 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-25604 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-02156 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-45142 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-45142 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-45142 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2023-0098 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2022-45142 · Vendor Advisory
• https://debian.org/security/2023/dsa-5344 · Vendor Advisory
• https://osv.dev/vulnerability/USN-5849-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2023-0098.html · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2022-45142 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-45142 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3311-1 · Vendor Advisory