CVE-2022-45142

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:heimdal_project:heimdal:7.7.1:*:*:*:*:*:*:*
cpe:2.3:a:heimdal_project:heimdal:7.8.0:*:*:*:*:*:*:*

History

08 Oct 2023, 09:15

Type Values Removed Values Added
References
  • (GENTOO) https://security.gentoo.org/glsa/202310-06 -

Information

Published : 2023-03-06 23:15

Updated : 2024-02-28 19:51


NVD link : CVE-2022-45142

Mitre link : CVE-2022-45142

CVE.ORG link : CVE-2022-45142


JSON object : View

Products Affected

heimdal_project

  • heimdal
CWE
CWE-354

Improper Validation of Integrity Check Value