diff options
Diffstat (limited to 'gnu/packages/patches/heimdal-CVE-2017-6594.patch')
| -rw-r--r-- | gnu/packages/patches/heimdal-CVE-2017-6594.patch | 85 |
1 files changed, 0 insertions, 85 deletions
diff --git a/gnu/packages/patches/heimdal-CVE-2017-6594.patch b/gnu/packages/patches/heimdal-CVE-2017-6594.patch deleted file mode 100644 index 714af60304..0000000000 --- a/gnu/packages/patches/heimdal-CVE-2017-6594.patch +++ /dev/null @@ -1,85 +0,0 @@ -Fix CVE-2017-6594: - -https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-6594 -https://security-tracker.debian.org/tracker/CVE-2017-6594 - -Patch lifted from upstream source repository: - -https://github.com/heimdal/heimdal/commit/b1e699103f08d6a0ca46a122193c9da65f6cf837 - -To apply the patch to Heimdal 1.5.3 release tarball, the changes to 'NEWS' and -files in 'tests/' are removed, and hunk #4 of 'kdc/krb5tgs.c' is modified. - -From b1e699103f08d6a0ca46a122193c9da65f6cf837 Mon Sep 17 00:00:00 2001 -From: Viktor Dukhovni <viktor@twosigma.com> -Date: Wed, 10 Aug 2016 23:31:14 +0000 -Subject: [PATCH] Fix transit path validation CVE-2017-6594 - -Commit f469fc6 (2010-10-02) inadvertently caused the previous hop realm -to not be added to the transit path of issued tickets. This may, in -some cases, enable bypass of capath policy in Heimdal versions 1.5 -through 7.2. - -Note, this may break sites that rely on the bug. With the bug some -incomplete [capaths] worked, that should not have. These may now break -authentication in some cross-realm configurations. ---- - NEWS | 14 ++++++++++++++ - kdc/krb5tgs.c | 12 ++++++++++-- - tests/kdc/check-kdc.in | 17 +++++++++++++++++ - tests/kdc/krb5.conf.in | 4 ++++ - 4 files changed, 45 insertions(+), 2 deletions(-) - -diff --git a/kdc/krb5tgs.c b/kdc/krb5tgs.c -index 6048b9c55..98503812f 100644 ---- a/kdc/krb5tgs.c -+++ b/kdc/krb5tgs.c -@@ -655,8 +655,12 @@ fix_transited_encoding(krb5_context context, - "Decoding transited encoding"); - return ret; - } -+ -+ /* -+ * If the realm of the presented tgt is neither the client nor the server -+ * realm, it is a transit realm and must be added to transited set. -+ */ - if(strcmp(client_realm, tgt_realm) && strcmp(server_realm, tgt_realm)) { -- /* not us, so add the previous realm to transited set */ - if (num_realms + 1 > UINT_MAX/sizeof(*realms)) { - ret = ERANGE; - goto free_realms; -@@ -737,6 +741,7 @@ tgs_make_reply(krb5_context context, - const char *server_name, - hdb_entry_ex *client, - krb5_principal client_principal, -+ const char *tgt_realm, - hdb_entry_ex *krbtgt, - krb5_enctype krbtgt_etype, - krb5_principals spp, -@@ -798,7 +803,7 @@ tgs_make_reply(krb5_context context, - &tgt->transited, &et, - krb5_principal_get_realm(context, client_principal), - krb5_principal_get_realm(context, server->entry.principal), -- krb5_principal_get_realm(context, krbtgt->entry.principal)); -+ tgt_realm); - if(ret) - goto out; - -@@ -1519,4 +1524,6 @@ tgs_build_reply(krb5_context context, - krb5_keyblock sessionkey; - krb5_kvno kvno; - krb5_data rspac; -+ const char *tgt_realm = /* Realm of TGT issuer */ -+ krb5_principal_get_realm(context, krbtgt->entry.principal); - -@@ -2324,6 +2331,7 @@ server_lookup: - spn, - client, - cp, -+ tgt_realm, - krbtgt_out, - tkey_sign->key.keytype, - spp, --- -2.13.3 - |