43 lines
1.6 KiB
Diff
43 lines
1.6 KiB
Diff
From ca75a685d19fec7c481fd3de9769ac3546e37a11 Mon Sep 17 00:00:00 2001
|
|
From: Isaac Boukris <iboukris@gmail.com>
|
|
Date: Sat, 15 Dec 2018 11:56:36 +0200
|
|
Subject: [PATCH] Remove incorrect KDC assertion
|
|
|
|
The assertion in return_enc_padata() is reachable because
|
|
kdc_make_s4u2self_rep() may have previously added encrypted padata.
|
|
It is no longer necessary because the code uses add_pa_data_element()
|
|
instead of allocating a new list.
|
|
|
|
CVE-2018-20217:
|
|
|
|
In MIT krb5 1.8 or later, an authenticated user who can obtain a TGT
|
|
using an older encryption type (DES, DES3, or RC4) can cause an
|
|
assertion failure in the KDC by sending an S4U2Self request.
|
|
|
|
[ghudson@mit.edu: rewrote commit message with CVE description]
|
|
|
|
ticket: 8767 (new)
|
|
tags: pullup
|
|
target_version: 1.17
|
|
target_version: 1.16-next
|
|
target_version: 1.15-next
|
|
|
|
(cherry picked from commit 94e5eda5bb94d1d44733a49c3d9b6d1e42c74def)
|
|
(cherry picked from commit 5ab44ff3ecdf362a792f193cf18df42866b70f80)
|
|
[rharwood@redhat.com: don't backport the tests]
|
|
---
|
|
src/kdc/kdc_preauth.c | 1 -
|
|
1 file changed, 1 deletion(-)
|
|
|
|
diff --git a/src/kdc/kdc_preauth.c b/src/kdc/kdc_preauth.c
|
|
index 811c16368..6f0cf68d9 100644
|
|
--- a/src/kdc/kdc_preauth.c
|
|
+++ b/src/kdc/kdc_preauth.c
|
|
@@ -1666,7 +1666,6 @@ return_enc_padata(krb5_context context, krb5_data *req_pkt,
|
|
krb5_error_code code = 0;
|
|
/* This should be initialized and only used for Win2K compat and other
|
|
* specific standardized uses such as FAST negotiation. */
|
|
- assert(reply_encpart->enc_padata == NULL);
|
|
if (is_referral) {
|
|
code = return_referral_enc_padata(context, reply_encpart, server);
|
|
if (code)
|