File 0115-Remove-incorrect-KDC-assertion.patch of Package krb5-mini.9899

Overview Repositories Revisions Requests Users Attributes Meta

File 0115-Remove-incorrect-KDC-assertion.patch of Package krb5-mini.9899

From 445f73af73448e054884d8379f2fff915c8b8120 Mon Sep 17 00:00:00 2001
From: Isaac Boukris <iboukris@gmail.com>
Date: Sat, 15 Dec 2018 11:56:36 +0200
Subject: [PATCH] Remove incorrect KDC assertion

The assertion in return_enc_padata() is reachable because
kdc_make_s4u2self_rep() may have previously added encrypted padata.
It is no longer necessary because the code uses add_pa_data_element()
instead of allocating a new list.

CVE-2018-20217:

In MIT krb5 1.8 or later, an authenticated user who can obtain a TGT
using an older encryption type (DES, DES3, or RC4) can cause an
assertion failure in the KDC by sending an S4U2Self request.

[ghudson@mit.edu: rewrote commit message with CVE description]

(cherry picked from commit 94e5eda5bb94d1d44733a49c3d9b6d1e42c74def)

ticket: 8767
version_fixed: 1.15.5

[scabrero@suse.de: tests not backported]
(cherry picked from commit 17cc01779e8e40cc414b39bc2a99fd48bb064124)
---
 src/kdc/kdc_preauth.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
index 50cc2520d..dbde29498 100644
--- a/src/kdc/kdc_preauth.c
+++ b/src/kdc/kdc_preauth.c
@@ -1700,7 +1700,6 @@ return_enc_padata(krb5_context context, krb5_data *req_pkt,
     krb5_error_code code = 0;
     /* This should be initialized and only used for Win2K compat and other
      * specific standardized uses such as FAST negotiation. */
-    assert(reply_encpart->enc_padata == NULL);
     if (is_referral) {
         code = return_referral_enc_padata(context, reply_encpart, server);
         if (code)
-- 
2.20.1

Places

File 0115-Remove-incorrect-KDC-assertion.patch of Package krb5-mini.9899

Places