CVE-2022-42898

NameCVE-2022-42898
Descriptionkrb5_pac_parse() buffer parsing vulnerability
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
ReferencesDLA-3206-1, DSA-5286-1, DSA-5287-1
Debian Bugs1024187, 1024267

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
heimdal (PTS)buster7.5.0+dfsg-3vulnerable
buster (security)7.5.0+dfsg-3+deb10u1fixed
bullseye7.7.0+dfsg-2vulnerable
bullseye (security)7.7.0+dfsg-2+deb11u2fixed
sid, bookworm7.7.0+dfsg-6vulnerable
krb5 (PTS)buster1.17-3+deb10u4vulnerable
buster (security)1.17-3+deb10u2vulnerable
bullseye1.18.3-6+deb11u2vulnerable
bullseye (security)1.18.3-6+deb11u3fixed
sid, bookworm1.20.1-1fixed
samba (PTS)buster, buster (security)2:4.9.5+dfsg-5+deb10u3vulnerable
bullseye (security), bullseye2:4.13.13+dfsg-1~deb11u5vulnerable
sid, bookworm2:4.17.3+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
heimdalsourcebuster7.5.0+dfsg-3+deb10u1DLA-3206-1
heimdalsourcebullseye7.7.0+dfsg-2+deb11u2DSA-5287-1
heimdalsource(unstable)(unfixed)1024187
krb5sourcebullseye1.18.3-6+deb11u3DSA-5286-1
krb5source(unstable)1.20.1-11024267
sambasource(unstable)2:4.17.3+dfsg-1

Notes

https://www.samba.org/samba/security/CVE-2022-42898.html
https://bugzilla.samba.org/show_bug.cgi?id=15203
MIT-krb5: https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583 (master)
MIT-krb5: https://github.com/krb5/krb5/commit/b99de751dd35360c0fccac74a40f4a60dbf1ceea (krb5-1.20.1-final)
MIT-krb5: https://github.com/krb5/krb5/commit/4e661f0085ec5f969c76c0896a34322c6c432de4 (krb5-1.19.4-final)
https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
Heimdal: https://github.com/heimdal/heimdal/commit/0c56257bdac80da015878fffdb0f8a42b8d73246 (heimdal-7.7.1)
Heimdal regression: https://github.com/heimdal/heimdal/pull/1025

Search for package or bug name: Reporting problems