Upstream information

CVE-2021-44758 at MITRE

Description

Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred_mech_type of GSS_C_NO_OID and a nonzero initial_response value to send_accept.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
  National Vulnerability Database
Base Score 7.5
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1205667 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP3
  • libasn1-8 >= 7.8.0-bp153.2.4.1
  • libgssapi3 >= 7.8.0-bp153.2.4.1
  • libhcrypto4 >= 7.8.0-bp153.2.4.1
  • libhdb9 >= 7.8.0-bp153.2.4.1
  • libheimbase1 >= 7.8.0-bp153.2.4.1
  • libheimdal-devel >= 7.8.0-bp153.2.4.1
  • libheimedit0 >= 7.8.0-bp153.2.4.1
  • libheimntlm0 >= 7.8.0-bp153.2.4.1
  • libhx509-5 >= 7.8.0-bp153.2.4.1
  • libkadm5clnt7 >= 7.8.0-bp153.2.4.1
  • libkadm5srv8 >= 7.8.0-bp153.2.4.1
  • libkafs0 >= 7.8.0-bp153.2.4.1
  • libkdc2 >= 7.8.0-bp153.2.4.1
  • libkrb5-26 >= 7.8.0-bp153.2.4.1
  • libotp0 >= 7.8.0-bp153.2.4.1
  • libroken18 >= 7.8.0-bp153.2.4.1
  • libsl0 >= 7.8.0-bp153.2.4.1
  • libwind0 >= 7.8.0-bp153.2.4.1
 Patchnames:
openSUSE-2023-20
SUSE Package Hub 15 SP4
  • libasn1-8 >= 7.8.0-bp154.2.4.1
  • libgssapi3 >= 7.8.0-bp154.2.4.1
  • libhcrypto4 >= 7.8.0-bp154.2.4.1
  • libhdb9 >= 7.8.0-bp154.2.4.1
  • libheimbase1 >= 7.8.0-bp154.2.4.1
  • libheimdal-devel >= 7.8.0-bp154.2.4.1
  • libheimedit0 >= 7.8.0-bp154.2.4.1
  • libheimntlm0 >= 7.8.0-bp154.2.4.1
  • libhx509-5 >= 7.8.0-bp154.2.4.1
  • libkadm5clnt7 >= 7.8.0-bp154.2.4.1
  • libkadm5srv8 >= 7.8.0-bp154.2.4.1
  • libkafs0 >= 7.8.0-bp154.2.4.1
  • libkdc2 >= 7.8.0-bp154.2.4.1
  • libkrb5-26 >= 7.8.0-bp154.2.4.1
  • libotp0 >= 7.8.0-bp154.2.4.1
  • libroken18 >= 7.8.0-bp154.2.4.1
  • libsl0 >= 7.8.0-bp154.2.4.1
  • libwind0 >= 7.8.0-bp154.2.4.1
 Patchnames:
openSUSE-2023-19
openSUSE Leap 15.3
  • libasn1-8 >= 7.8.0-bp153.2.4.1
  • libgssapi3 >= 7.8.0-bp153.2.4.1
  • libhcrypto4 >= 7.8.0-bp153.2.4.1
  • libhdb9 >= 7.8.0-bp153.2.4.1
  • libheimbase1 >= 7.8.0-bp153.2.4.1
  • libheimdal-devel >= 7.8.0-bp153.2.4.1
  • libheimedit0 >= 7.8.0-bp153.2.4.1
  • libheimntlm0 >= 7.8.0-bp153.2.4.1
  • libhx509-5 >= 7.8.0-bp153.2.4.1
  • libkadm5clnt7 >= 7.8.0-bp153.2.4.1
  • libkadm5srv8 >= 7.8.0-bp153.2.4.1
  • libkafs0 >= 7.8.0-bp153.2.4.1
  • libkdc2 >= 7.8.0-bp153.2.4.1
  • libkrb5-26 >= 7.8.0-bp153.2.4.1
  • libotp0 >= 7.8.0-bp153.2.4.1
  • libroken18 >= 7.8.0-bp153.2.4.1
  • libsl0 >= 7.8.0-bp153.2.4.1
  • libwind0 >= 7.8.0-bp153.2.4.1
 Patchnames:
openSUSE-2023-20
openSUSE Leap 15.4
  • libasn1-8 >= 7.8.0-bp154.2.4.1
  • libgssapi3 >= 7.8.0-bp154.2.4.1
  • libhcrypto4 >= 7.8.0-bp154.2.4.1
  • libhdb9 >= 7.8.0-bp154.2.4.1
  • libheimbase1 >= 7.8.0-bp154.2.4.1
  • libheimdal-devel >= 7.8.0-bp154.2.4.1
  • libheimedit0 >= 7.8.0-bp154.2.4.1
  • libheimntlm0 >= 7.8.0-bp154.2.4.1
  • libhx509-5 >= 7.8.0-bp154.2.4.1
  • libkadm5clnt7 >= 7.8.0-bp154.2.4.1
  • libkadm5srv8 >= 7.8.0-bp154.2.4.1
  • libkafs0 >= 7.8.0-bp154.2.4.1
  • libkdc2 >= 7.8.0-bp154.2.4.1
  • libkrb5-26 >= 7.8.0-bp154.2.4.1
  • libotp0 >= 7.8.0-bp154.2.4.1
  • libroken18 >= 7.8.0-bp154.2.4.1
  • libsl0 >= 7.8.0-bp154.2.4.1
  • libwind0 >= 7.8.0-bp154.2.4.1
 Patchnames:
openSUSE-2023-19
openSUSE Tumbleweed
  • libasn1-8 >= 7.8.0-1.1
  • libgssapi3 >= 7.8.0-1.1
  • libhcrypto4 >= 7.8.0-1.1
  • libhdb9 >= 7.8.0-1.1
  • libheimbase1 >= 7.8.0-1.1
  • libheimdal-devel >= 7.8.0-1.1
  • libheimedit0 >= 7.8.0-1.1
  • libheimntlm0 >= 7.8.0-1.1
  • libhx509-5 >= 7.8.0-1.1
  • libkadm5clnt7 >= 7.8.0-1.1
  • libkadm5srv8 >= 7.8.0-1.1
  • libkafs0 >= 7.8.0-1.1
  • libkdc2 >= 7.8.0-1.1
  • libkrb5-26 >= 7.8.0-1.1
  • libotp0 >= 7.8.0-1.1
  • libroken18 >= 7.8.0-1.1
  • libsl0 >= 7.8.0-1.1
  • libwind0 >= 7.8.0-1.1
 Patchnames:
openSUSE Tumbleweed GA libasn1-8-7.8.0-1.1

SUSE Timeline for this CVE

CVE page created: Tue Nov 22 22:00:08 2022
CVE page last modified: Tue May 23 18:12:57 2023