[bug#62760] [PATCH 0/3] Two serious vulnerabilities in Heimdal Kerberos

[Felix Lechner]

Hi,

This patch series addresses two serious vulnerabilities in Heimdal, which is
an implementation of the Kerberos protocol and therefore a security-relevant
package.

First, the version being shipped currently in Guix suffers from "a severe
vulnerability, possibly a 10.0 on the Common Vulnerability Scoring System
(CVSS) v3." The upstream developers "believe it should be possible to get an
RCE [remote code execution] on a KDC, which means that credentials can be
compromised that can be used to impersonate anyone in a realm or forest of
realms." "While no zero-day exploit is known, such an exploit will likely be
available soon after public disclosure." [1]

Second, all recent upstream releases (but not the development branch) suffer
from a serious backporting error that NIST scored at a "7.5 HIGH". That issue
is being patched here. [2]

Finally, we enabled OpenLDAP support for the principals database (which is
different from using LDAP for user authorization) and modified the inputs to
be more in line with Debian packaging.

The packaging presented here passed some cursory testing for basic client and
server functionality locally, but that version did not include the patch for
CVE-2022-45142 because I did not know how to add it to my custom channel.

Kind regards
Felix Lechner

[1] https://github.com/heimdal/heimdal/releases/tag/heimdal-7.8.0
[2] https://www.openwall.com/lists/oss-security/2023/02/08/1

* * *

Felix Lechner (3):
  gnu: heimdal: Update to 7.8.0.
  gnu: heimdal: Patch for CVE-2022-45142.
  gnu: heimdal: Enable OpenLDAP support; converge inputs toward Debian
    packaging.

 gnu/packages/kerberos.scm                     | 25 +++++++---
 .../patches/heimdal-CVE-2022-45142.patch      | 49 +++++++++++++++++++
 2 files changed, 68 insertions(+), 6 deletions(-)
 create mode 100644 gnu/packages/patches/heimdal-CVE-2022-45142.patch


base-commit: b08cdfc6d363e9ca63118303b4628542c54a612d
-- 
2.39.2