Vulnerability in heimdal package - CVE-2022-45142
Summary
CVE-2022-45142: The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. Affects heimdal across 3 version ranges.
< 7.7.1-r1
< 78077c39e355766221383ee48c8b9be0459a82a4
< a6cf94577c0d1e5bca5304342e4ddffb18255afe
Fixed in 7.7.1-r1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The heimdal package is a software library that provides support for the Kerberos network authentication protocol. It is commonly used in various operating systems and applications to enable secure authentication and encryption. However, a vulnerability has been discovered in the heimdal package, which could potentially lead to the compromise of message integrity codes in the gssapi/arcfour component.
Vulnerability Detail
The vulnerability (CVE-2022-45142) originated from a logic inversion introduced during the backporting of patches for CVE-2022-3437. This inversion caused the validation of message integrity codes in gssapi/arcfour to be inverted, potentially allowing attackers to bypass authentication and tamper with encrypted data. The vulnerability has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
7.7.1-r1
This is the first release that contains the fix.
sudo apk add --upgrade heimdalTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If updating the package is not immediately feasible, a temporary workaround can be implemented by disabling or restricting the usage of gssapi/arcfour in affected applications. This can be achieved by modifying the application configuration or code to use alternative authentication mechanisms or cryptographic algorithms.
Conclusion
In conclusion, the heimdal package is vulnerable to CVE-2022-45142, which could allow attackers to bypass authentication and tamper with encrypted data. It is crucial to update the package to the recommended versions or apply the provided workaround to mitigate the risk. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for heimdal →
FAQ
The vulnerability could allow attackers to bypass authentication and tamper with encrypted data, potentially leading to unauthorized access, data manipulation, or information disclosure.
The vulnerability affects heimdal versions 0 to 7.7.1-r1 for Alpine v3.14, 0 to 7.7.1-r0 for Alpine v3.15 and v3.16, and 0 to 7.8.0-r1 for Alpine v3.17 and v3.18.
At the time of this report, there are no known public exploits specifically targeting this vulnerability. However, it is important to apply the recommended fixes and security updates to mitigate any potential risks.
Yes, the vulnerability can be exploited remotely by attackers who have network access to the affected system or application.
For more detailed technical information about this vulnerability, you can refer to the official CVE-2022-45142 JSON report available at the following source: https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-45142.json
References
Related vulnerabilities
Recent vulnerabilities recorded for heimdal.
