7.5
Élevée
CVE-2022-45142 The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!=…
Description
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| samba | Versions non publiées |
Références
- www.openwall.com www.openwall.com
- GLSA-202310-06 security.gentoo.org
Chronologie
- Publiée
- Dernière modification
Autres CVE de samba
Les 40 CVE de samba →
CVE-2023-4154
A design flaw was found in Samba's DirSync control implementation, which exposes passwords and secrets in Active…
7.5
Élevée
CVE-2023-0614
The fix in 4.6.16, 4.7.9, 4.8.4 and 4.9.7 for CVE-2018-10919 Confidential attribute disclosure vi LDAP filters was…
7.7
Élevée
CVE-2023-0922
The Samba AD DC administration tool, when operating against a remote LDAP server, will by default send new or reset…
5.9
Moyenne
CVE-2023-0225
A flaw was found in Samba
4.3
Moyenne