Hi, This patch series addresses two serious vulnerabilities in Heimdal, which is an implementation of the Kerberos protocol and therefore a security-relevant package.
First, the version being shipped currently in Guix suffers from "a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring System (CVSS) v3." The upstream developers "believe it should be possible to get an RCE [remote code execution] on a KDC, which means that credentials can be compromised that can be used to impersonate anyone in a realm or forest of realms." "While no zero-day exploit is known, such an exploit will likely be available soon after public disclosure." [1] Second, all recent upstream releases (but not the development branch) suffer from a serious backporting error that NIST scored at a "7.5 HIGH". That issue is being patched here. [2] Finally, we enabled OpenLDAP support for the principals database (which is different from using LDAP for user authorization) and modified the inputs to be more in line with Debian packaging. The packaging presented here passed some cursory testing for basic client and server functionality locally, but that version did not include the patch for CVE-2022-45142 because I did not know how to add it to my custom channel. Kind regards Felix Lechner [1] https://github.com/heimdal/heimdal/releases/tag/heimdal-7.8.0 [2] https://www.openwall.com/lists/oss-security/2023/02/08/1 * * * Felix Lechner (3): gnu: heimdal: Update to 7.8.0. gnu: heimdal: Patch for CVE-2022-45142. gnu: heimdal: Enable OpenLDAP support; converge inputs toward Debian packaging. gnu/packages/kerberos.scm | 25 +++++++--- .../patches/heimdal-CVE-2022-45142.patch | 49 +++++++++++++++++++ 2 files changed, 68 insertions(+), 6 deletions(-) create mode 100644 gnu/packages/patches/heimdal-CVE-2022-45142.patch base-commit: b08cdfc6d363e9ca63118303b4628542c54a612d -- 2.39.2
