Upstream information

CVE-2022-41916 at MITRE

Description

Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos. Versions prior to 7.7.1 are vulnerable to a denial of service vulnerability in Heimdal's PKI certificate validation library, affecting the KDC (via PKINIT) and kinit (via PKINIT), as well as any third-party applications using Heimdal's libhx509. Users should upgrade to Heimdal 7.7.1 or 7.8. There are no known workarounds for this issue.

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having important severity.

CVSS v3 Scores
  National Vulnerability Database
Base Score 5.9
Vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Impact None
Integrity Impact None
Availability Impact High
CVSSv3 Version 3.1
SUSE Bugzilla entry: 1205667 [RESOLVED / FIXED]

SUSE Security Advisories:

List of released packages

Product(s) Fixed package version(s) References
SUSE Package Hub 15 SP3
  • libasn1-8 >= 7.8.0-bp153.2.4.1
  • libgssapi3 >= 7.8.0-bp153.2.4.1
  • libhcrypto4 >= 7.8.0-bp153.2.4.1
  • libhdb9 >= 7.8.0-bp153.2.4.1
  • libheimbase1 >= 7.8.0-bp153.2.4.1
  • libheimdal-devel >= 7.8.0-bp153.2.4.1
  • libheimedit0 >= 7.8.0-bp153.2.4.1
  • libheimntlm0 >= 7.8.0-bp153.2.4.1
  • libhx509-5 >= 7.8.0-bp153.2.4.1
  • libkadm5clnt7 >= 7.8.0-bp153.2.4.1
  • libkadm5srv8 >= 7.8.0-bp153.2.4.1
  • libkafs0 >= 7.8.0-bp153.2.4.1
  • libkdc2 >= 7.8.0-bp153.2.4.1
  • libkrb5-26 >= 7.8.0-bp153.2.4.1
  • libotp0 >= 7.8.0-bp153.2.4.1
  • libroken18 >= 7.8.0-bp153.2.4.1
  • libsl0 >= 7.8.0-bp153.2.4.1
  • libwind0 >= 7.8.0-bp153.2.4.1
 Patchnames:
openSUSE-2023-20
SUSE Package Hub 15 SP4
  • libasn1-8 >= 7.8.0-bp154.2.4.1
  • libgssapi3 >= 7.8.0-bp154.2.4.1
  • libhcrypto4 >= 7.8.0-bp154.2.4.1
  • libhdb9 >= 7.8.0-bp154.2.4.1
  • libheimbase1 >= 7.8.0-bp154.2.4.1
  • libheimdal-devel >= 7.8.0-bp154.2.4.1
  • libheimedit0 >= 7.8.0-bp154.2.4.1
  • libheimntlm0 >= 7.8.0-bp154.2.4.1
  • libhx509-5 >= 7.8.0-bp154.2.4.1
  • libkadm5clnt7 >= 7.8.0-bp154.2.4.1
  • libkadm5srv8 >= 7.8.0-bp154.2.4.1
  • libkafs0 >= 7.8.0-bp154.2.4.1
  • libkdc2 >= 7.8.0-bp154.2.4.1
  • libkrb5-26 >= 7.8.0-bp154.2.4.1
  • libotp0 >= 7.8.0-bp154.2.4.1
  • libroken18 >= 7.8.0-bp154.2.4.1
  • libsl0 >= 7.8.0-bp154.2.4.1
  • libwind0 >= 7.8.0-bp154.2.4.1
 Patchnames:
openSUSE-2023-19
openSUSE Leap 15.3
  • libasn1-8 >= 7.8.0-bp153.2.4.1
  • libgssapi3 >= 7.8.0-bp153.2.4.1
  • libhcrypto4 >= 7.8.0-bp153.2.4.1
  • libhdb9 >= 7.8.0-bp153.2.4.1
  • libheimbase1 >= 7.8.0-bp153.2.4.1
  • libheimdal-devel >= 7.8.0-bp153.2.4.1
  • libheimedit0 >= 7.8.0-bp153.2.4.1
  • libheimntlm0 >= 7.8.0-bp153.2.4.1
  • libhx509-5 >= 7.8.0-bp153.2.4.1
  • libkadm5clnt7 >= 7.8.0-bp153.2.4.1
  • libkadm5srv8 >= 7.8.0-bp153.2.4.1
  • libkafs0 >= 7.8.0-bp153.2.4.1
  • libkdc2 >= 7.8.0-bp153.2.4.1
  • libkrb5-26 >= 7.8.0-bp153.2.4.1
  • libotp0 >= 7.8.0-bp153.2.4.1
  • libroken18 >= 7.8.0-bp153.2.4.1
  • libsl0 >= 7.8.0-bp153.2.4.1
  • libwind0 >= 7.8.0-bp153.2.4.1
 Patchnames:
openSUSE-2023-20
openSUSE Leap 15.4
  • libasn1-8 >= 7.8.0-bp154.2.4.1
  • libgssapi3 >= 7.8.0-bp154.2.4.1
  • libhcrypto4 >= 7.8.0-bp154.2.4.1
  • libhdb9 >= 7.8.0-bp154.2.4.1
  • libheimbase1 >= 7.8.0-bp154.2.4.1
  • libheimdal-devel >= 7.8.0-bp154.2.4.1
  • libheimedit0 >= 7.8.0-bp154.2.4.1
  • libheimntlm0 >= 7.8.0-bp154.2.4.1
  • libhx509-5 >= 7.8.0-bp154.2.4.1
  • libkadm5clnt7 >= 7.8.0-bp154.2.4.1
  • libkadm5srv8 >= 7.8.0-bp154.2.4.1
  • libkafs0 >= 7.8.0-bp154.2.4.1
  • libkdc2 >= 7.8.0-bp154.2.4.1
  • libkrb5-26 >= 7.8.0-bp154.2.4.1
  • libotp0 >= 7.8.0-bp154.2.4.1
  • libroken18 >= 7.8.0-bp154.2.4.1
  • libsl0 >= 7.8.0-bp154.2.4.1
  • libwind0 >= 7.8.0-bp154.2.4.1
 Patchnames:
openSUSE-2023-19
openSUSE Tumbleweed
  • libasn1-8 >= 7.8.0-1.1
  • libgssapi3 >= 7.8.0-1.1
  • libhcrypto4 >= 7.8.0-1.1
  • libhdb9 >= 7.8.0-1.1
  • libheimbase1 >= 7.8.0-1.1
  • libheimdal-devel >= 7.8.0-1.1
  • libheimedit0 >= 7.8.0-1.1
  • libheimntlm0 >= 7.8.0-1.1
  • libhx509-5 >= 7.8.0-1.1
  • libkadm5clnt7 >= 7.8.0-1.1
  • libkadm5srv8 >= 7.8.0-1.1
  • libkafs0 >= 7.8.0-1.1
  • libkdc2 >= 7.8.0-1.1
  • libkrb5-26 >= 7.8.0-1.1
  • libotp0 >= 7.8.0-1.1
  • libroken18 >= 7.8.0-1.1
  • libsl0 >= 7.8.0-1.1
  • libwind0 >= 7.8.0-1.1
 Patchnames:
openSUSE Tumbleweed GA libasn1-8-7.8.0-1.1

SUSE Timeline for this CVE

CVE page created: Wed Nov 16 07:00:10 2022
CVE page last modified: Tue May 23 18:25:20 2023