diff options
| author | Polampalli, Archana ñ <archana.polampalli@windriver.com> | 2023-06-16 12:19:31 +0000 |
|---|---|---|
| committer | Armin Kuster <akuster808@gmail.com> | 2023-06-17 14:21:38 -0400 |
| commit | 84544d644086e5e003fbd4056ae5e9135a94ac00 (patch) | |
| tree | 3a8c6cbf91210d0851367043b08b7195ee70b6e4 /meta-python/recipes-devtools/python/python3-lazy-object-proxy_1.7.1.bb | |
| parent | 9d203efe8f01fa7d433a52ae1098cb27ede07119 (diff) | |
| download | meta-openembedded-84544d644086e5e003fbd4056ae5e9135a94ac00.tar.gz | |
samba: fix CVE-2022-45142
The fix for CVE-2022-3437 included changing memcmp to be constant
time and a workaround for a compiler bug by adding "!= 0"
comparisons to the result of memcmp. When these patches were
backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and
possibly other branches) a logic inversion sneaked in causing the
validation of message integrity codes in gssapi/arcfour to be inverted.
References:
https://nvd.nist.gov/vuln/detail/CVE-2022-45142
Upstream patches:
https://www.openwall.com/lists/oss-security/2023/02/08/1
https://github.com/heimdal/heimdal/commit/5f63215d0d82678233fdfb1c07f4b421f57c528b
Signed-off-by: Archana Polampalli <archana.polampalli@windriver.com>
Signed-off-by: Armin Kuster <akuster808@gmail.com>
Diffstat (limited to 'meta-python/recipes-devtools/python/python3-lazy-object-proxy_1.7.1.bb')
0 files changed, 0 insertions, 0 deletions