The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published: 2023-03-06T00:00:00

Updated: 2024-08-03T14:09:56.389Z

Reserved: 2022-11-10T00:00:00

Link: CVE-2022-45142

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2023-03-06T23:15:11.233

Modified: 2024-11-21T07:28:50.383

Link: CVE-2022-45142

cve-icon Redhat

Severity : Important

Publid Date: 2023-02-08T00:00:00Z

Links: CVE-2022-45142 - Bugzilla