CVE-2022-45142

Name of the Vulnerable Software and Affected Versions heimdal versions 7.7.1 through 7.8.0

Description The issue is related to the implementation of the Kerberos5 protocol in heimdal, specifically concerning incorrect validation of message integrity codes. This can allow a remote attacker to cause a logical inversion, resulting in the validation of message integrity codes in gssapi/arcfour to be inverted.

Recommendations For heimdal versions 7.7.1 through 7.8.0, consider applying the original fix for the issue without the logic inversion, which includes changing memcmp to be constant time and adding "!= 0" comparisons to the result of memcmp. At the moment, there is no information about a newer version that contains a fix for this vulnerability.