From nobody Tue Nov 15 16:38:26 2022 X-Original-To: dev-commits-ports-branches@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4NBX1G53B1z4hBYP; Tue, 15 Nov 2022 16:38:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4NBX1G4ZPLz3tps; Tue, 15 Nov 2022 16:38:26 +0000 (UTC) (envelope-from git@FreeBSD.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1668530306; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+5UJu+pdBt4TvfoanZu4TbEvqAnWWCJg99pEk8deNYA=; b=c0ic0S6/IYQtAqo03EENAPZJoS0TCIk1ZXnaUnyN26qnqbQPtrmA3a9eyIUZYKObB1yUe2 f8gyF434Oz7/PKMGRUJ7d3F61j7l3BwCRc1SMt/mEob5xh2t8kZfMt4uHtWLh4LTpGcfBX Kvmz8vxKK1KwWGC4XClgf64Z+YnsQj+Xh5nxO+qJiOYAALFrmic2GFDax0zlo++SauSmEh SXJAeU8moonwG1RIz5vVAeOSs19tJNdCqjO0AFQMJTJx0UjysT08rkWvDscoYBNQCx7G86 zTaVTCnLKnbFqvxr2CN3dqKMLJSyohhRmGziZ0AqHQVnHPv2Qpb0ea2RHMRmXw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1668530306; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=+5UJu+pdBt4TvfoanZu4TbEvqAnWWCJg99pEk8deNYA=; b=PGGxVHXntAHOYCSXAOOsj1tXYmNNbcOz4Jciu6ZNYxLrpPn3djLrCUlQIty1QJm5RlRcLZ atHmwrSsgg5voEHduYjJMmMZ6R46QBDPC7rdury/oW41FgrnjoCw16hWK88LE6/PDOqEsF 8Xdj0L0AGwiQhg77dTT8GnjeqcEsE4LVAxR5LVrArx6YVT6NeEUOiH6zzeBTLGvdSxm9e1 dTinJe90Spuj3eAVw/VNsWqgIcXuodAx3eh0HCTC1iOtSyuL7ijpGlZC/0RDHPt3x+4mSi rAWILBGVEaj5CNN0LDDelnoQhlnL6RZ0UkaL4vYPe0D70YgA0P5TNMkrUuD30A== ARC-Authentication-Results: i=1; mx1.freebsd.org; none ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1668530306; a=rsa-sha256; cv=none; b=QNLLN7TY7CqRL7IeJ7rQW3nJKlj8LDw78X+PNhdxSxEpqvcsUHuGA1gkt45ko/vObe8+8n euJIR7GyGH7+DmAYy9g0mQjkLwzeHCFezFu3sSncPVc+twDn7wnzxC+RIavx+wZl/Qh/dR JM+wXgcuD82LbLk8MWq+qBgtpsJcmGGYfi1UQO7MQzDVq6D/ItDlSVjQeoMz0e9dyUNIKN 12hky1nstshvhTm0a13IYsV7+KYMRatKjLSqSBwqKW5wPAjljUAbu8yhWBtMl9oGYT8vWt 5JotVntzqE1pGU/tiv7CmIfCNeSASi8Gij+0RhyCUIO5TSdR1Xu2nS/H3/wqCw== Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 4NBX1G3cZCzTxc; Tue, 15 Nov 2022 16:38:26 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 2AFGcQDM029413; Tue, 15 Nov 2022 16:38:26 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 2AFGcQet029412; Tue, 15 Nov 2022 16:38:26 GMT (envelope-from git) Date: Tue, 15 Nov 2022 16:38:26 GMT Message-Id: <202211151638.2AFGcQet029412@gitrepo.freebsd.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-branches@FreeBSD.org From: Cy Schubert Subject: git: a718d88e0772 - 2022Q4 - security/krb5-*: Address CVE-2022-42898 List-Id: Commits to the quarterly branches of the FreeBSD ports repository List-Archive: https://lists.freebsd.org/archives/dev-commits-ports-branches List-Help: List-Post: List-Subscribe: List-Unsubscribe: Sender: owner-dev-commits-ports-branches@freebsd.org X-BeenThere: dev-commits-ports-branches@freebsd.org MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: cy X-Git-Repository: ports X-Git-Refname: refs/heads/2022Q4 X-Git-Reftype: branch X-Git-Commit: a718d88e077255f3c6b124b1be30cfc9e9d2e58e Auto-Submitted: auto-generated X-ThisMailContainsUnwantedMimeParts: N The branch 2022Q4 has been updated by cy: URL: https://cgit.FreeBSD.org/ports/commit/?id=a718d88e077255f3c6b124b1be30cfc9e9d2e58e commit a718d88e077255f3c6b124b1be30cfc9e9d2e58e Author: Cy Schubert AuthorDate: 2022-11-15 16:27:50 +0000 Commit: Cy Schubert CommitDate: 2022-11-15 16:37:57 +0000 security/krb5-*: Address CVE-2022-42898 Topic: Vulnerabilities in PAC parsing CVE-2022-42898: integer overflow vulnerabilities in PAC parsing SUMMARY ======= Three integer overflow vulnerabilities have been discovered in the MIT krb5 library function krb5_parse_pac(). IMPACT ====== An authenticated attacker may be able to cause a KDC or kadmind process to crash by reading beyond the bounds of allocated memory, creating a denial of service. A privileged attacker may similarly be able to cause a Kerberos or GSS application service to crash. On a 32-bit platform, an authenticated attacker may be able to cause heap corruption in a KDC or kadmind process, possibly leading to remote code execution. A privileged attacker may similarly be able to cause heap corruption in a Kerberos or GSS application service running on a 32-bit platform. An attacker with the privileges of a cross-realm KDC may be able to extract secrets from a KDC process's memory by having them copied into the PAC of a new ticket. AFFECTED SOFTWARE ================= Kerberos and GSS application services using krb5-1.8 or later are affected. kadmind in krb5-1.8 or later is affected. The krb5-1.20 KDC is affected. The krb5-1.8 through krb5-1.19 KDC is affected when using the Samba or FreeIPA KDB modules. REFERENCES ========== This announcement is posted at: https://web.mit.edu/kerberos/advisories/MITKRB5-SA-2022-001.txt This announcement and related security advisories may be found on the MIT Kerberos security advisory page at: https://web.mit.edu/kerberos/advisories/index.html The main MIT Kerberos web page is at: https://web.mit.edu/kerberos/index.html CVE: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42898 Security: CVE-2022-42898 (cherry picked from commit de40003bfd697e98cdd342e253699e83e1040961) --- security/krb5-119/Makefile | 2 ++ security/krb5-119/distinfo | 4 +++- security/krb5-120/Makefile | 2 ++ security/krb5-120/distinfo | 4 +++- 4 files changed, 10 insertions(+), 2 deletions(-) diff --git a/security/krb5-119/Makefile b/security/krb5-119/Makefile index e0668fe68b6b..a598987a8290 100644 --- a/security/krb5-119/Makefile +++ b/security/krb5-119/Makefile @@ -1,5 +1,6 @@ PORTNAME= krb5 PORTVERSION= 1.19.3 +PORTREVISION= 1 CATEGORIES= security MASTER_SITES= http://web.mit.edu/kerberos/dist/${PORTNAME}/${PORTVERSION:C/^[0-9]*\.[0-9]*/&X/:C/X\.[0-9]*$//:C/X//}/ .if !defined(MASTERDIR) @@ -8,6 +9,7 @@ PKGNAMESUFFIX= -119 PATCH_SITES= http://web.mit.edu/kerberos/advisories/ PATCH_DIST_STRIP= -p2 +PATCHFILES= 2022-001-patch-r119.txt MAINTAINER= cy@FreeBSD.org COMMENT= MIT implementation of RFC 4120 network authentication service diff --git a/security/krb5-119/distinfo b/security/krb5-119/distinfo index a5f3bcd0c84b..aee7180b8355 100644 --- a/security/krb5-119/distinfo +++ b/security/krb5-119/distinfo @@ -1,3 +1,5 @@ -TIMESTAMP = 1647101273 +TIMESTAMP = 1668529517 SHA256 (krb5-1.19.3.tar.gz) = 56d04863cfddc9d9eb7af17556e043e3537d41c6e545610778676cf551b9dcd0 SIZE (krb5-1.19.3.tar.gz) = 8741343 +SHA256 (2022-001-patch-r119.txt) = e6e50807528cdda07fe8d946b0b417403168ff1e442ed4dbf099f20262c25867 +SIZE (2022-001-patch-r119.txt) = 3536 diff --git a/security/krb5-120/Makefile b/security/krb5-120/Makefile index d7fd0095f7a3..d0f689478dae 100644 --- a/security/krb5-120/Makefile +++ b/security/krb5-120/Makefile @@ -1,5 +1,6 @@ PORTNAME= krb5 PORTVERSION= 1.20 +PORTREVISION= 1 CATEGORIES= security MASTER_SITES= http://web.mit.edu/kerberos/dist/${PORTNAME}/${PORTVERSION:C/^[0-9]*\.[0-9]*/&X/:C/X\.[0-9]*$//:C/X//}/ .if !defined(MASTERDIR) @@ -8,6 +9,7 @@ PKGNAMESUFFIX= -120 PATCH_SITES= http://web.mit.edu/kerberos/advisories/ PATCH_DIST_STRIP= -p2 +PATCHFILES= 2022-001-patch-r120.txt MAINTAINER= cy@FreeBSD.org COMMENT= MIT implementation of RFC 4120 network authentication service diff --git a/security/krb5-120/distinfo b/security/krb5-120/distinfo index a6aaac17bfbc..bd9dce75f180 100644 --- a/security/krb5-120/distinfo +++ b/security/krb5-120/distinfo @@ -1,3 +1,5 @@ -TIMESTAMP = 1653608400 +TIMESTAMP = 1668529430 SHA256 (krb5-1.20.tar.gz) = 7e022bdd3c851830173f9faaa006a230a0e0fdad4c953e85bff4bf0da036e12f SIZE (krb5-1.20.tar.gz) = 8660756 +SHA256 (2022-001-patch-r120.txt) = 7e4589910db665142ba04b45eb8f64d0a3dd30e67c0010e449048600ece0bcc9 +SIZE (2022-001-patch-r120.txt) = 3539