[SECURITY] Fedora 36 Update: heimdal-7.7.1-3.fc36
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2022-dba9ba8e2b
2022-11-30 01:33:56.429768
--------------------------------------------------------------------------------
Name : heimdal
Product : Fedora 36
Version : 7.7.1
Release : 3.fc36
URL : http://www.heimdal.software/
Summary : A Kerberos 5 implementation without export restrictions
Description :
Kerberos 5 is a network authentication and single sign-on system.
Heimdal is a free Kerberos 5 implementation without export restrictions
written from the spec (rfc1510 and successors) including advanced features
like thread safety, IPv6, master-slave replication of Kerberos Key
Distribution Center server and support for ticket delegation (S4U2Self,
S4U2Proxy).
This package can coexist with MIT Kerberos 5 packages. Hesiod is disabled
by default since it is deemed too big a security risk by the packager.
--------------------------------------------------------------------------------
Update Information:
Fixes: * Delay service starts until after network is online (rhbz#2005501) *
Restart services on package update (will apply when updating from this release)
---- This release fixes the following Security Vulnerabilities: *
CVE-2022-42898 PAC parse integer overflows * CVE-2022-3437 Overflows and non-
constant time leaks in DES{,3} and arcfour * CVE-2022-41916 Fix Unicode
normalization read of 1 bytes past end of array * CVE-2021-44758 NULL
dereference DoS in SPNEGO acceptors * CVE-2021-3671 A null pointer de-reference
when handling missing sname in TGS-REQ * CVE-2022-44640 Heimdal KDC: invalid
free in ASN.1 codec Note that CVE-2022-44640 is a severe vulnerability,
possibly a 10.0 on the Common Vulnerability Scoring System (CVSS) v3.
--------------------------------------------------------------------------------
ChangeLog:
* Mon Nov 21 2022 Alexander Bostr��m <abo(a)root.snowtree.se> - 7.7.1-3
- Restart services on upgrade
* Mon Nov 21 2022 Alexander Bostr��m <abo(a)root.snowtree.se> - 7.7.1-2
- Delay service starts until after network is online (rhbz#2005501)
* Wed Nov 16 2022 Alexander Bostr��m <abo(a)root.snowtree.se> - 7.7.1-1
- Update to 7.7.1
- Remove upstreamed patch
- Replace patch with sed command
* Thu Jul 21 2022 Fedora Release Engineering <releng(a)fedoraproject.org> - 7.7.0-12
- Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
--------------------------------------------------------------------------------
This update can be installed with the "dnf" update program. Use
su -c 'dnf upgrade --advisory FEDORA-2022-dba9ba8e2b' at the command
line. For more information, refer to the dnf documentation available at
http://dnf.readthedocs.io/en/latest/command_ref.html#upgrade-command-label
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------