1 |
commit: 16e1279e1a0b87ab89031972ea5b9f5136a67e76 |
2 |
Author: Eray Aslan <eras <AT> gentoo <DOT> org> |
3 |
AuthorDate: Wed Jan 5 09:56:43 2022 +0000 |
4 |
Commit: Eray Aslan <eras <AT> gentoo <DOT> org> |
5 |
CommitDate: Wed Jan 5 09:56:43 2022 +0000 |
6 |
URL: https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=16e1279e |
7 |
|
8 |
app-crypt/mit-krb5: security bump |
9 |
|
10 |
Bug: https://bugs.gentoo.org/809845 |
11 |
Package-Manager: Portage-3.0.30, Repoman-3.0.3 |
12 |
Signed-off-by: Eray Aslan <eras <AT> gentoo.org> |
13 |
|
14 |
.../mit-krb5/files/mit-krb5-CVE-2021-37750.patch | 43 ++++++ |
15 |
app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild | 165 +++++++++++++++++++++ |
16 |
2 files changed, 208 insertions(+) |
17 |
|
18 |
diff --git a/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch b/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch |
19 |
new file mode 100644 |
20 |
index 000000000000..2f4c949e9f31 |
21 |
--- /dev/null |
22 |
+++ b/app-crypt/mit-krb5/files/mit-krb5-CVE-2021-37750.patch |
23 |
@@ -0,0 +1,43 @@ |
24 |
+From d775c95af7606a51bf79547a94fa52ddd1cb7f49 Mon Sep 17 00:00:00 2001 |
25 |
+From: Greg Hudson <ghudson@×××.edu> |
26 |
+Date: Tue, 3 Aug 2021 01:15:27 -0400 |
27 |
+Subject: [PATCH] Fix KDC null deref on TGS inner body null server |
28 |
+ |
29 |
+After the KDC decodes a FAST inner body, it does not check for a null |
30 |
+server. Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this |
31 |
+would typically result in an error from krb5_unparse_name(), but with |
32 |
+the addition of get_local_tgt() it results in a null dereference. Add |
33 |
+a null check. |
34 |
+ |
35 |
+Reported by Joseph Sutton of Catalyst. |
36 |
+ |
37 |
+CVE-2021-37750: |
38 |
+ |
39 |
+In MIT krb5 releases 1.14 and later, an authenticated attacker can |
40 |
+cause a null dereference in the KDC by sending a FAST TGS request with |
41 |
+no server field. |
42 |
+ |
43 |
+ticket: 9008 (new) |
44 |
+tags: pullup |
45 |
+target_version: 1.19-next |
46 |
+target_version: 1.18-next |
47 |
+--- |
48 |
+ src/kdc/do_tgs_req.c | 5 +++++ |
49 |
+ 1 file changed, 5 insertions(+) |
50 |
+ |
51 |
+diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c |
52 |
+index 582e497cc9..32dc65fa8e 100644 |
53 |
+--- a/kdc/do_tgs_req.c |
54 |
++++ b/kdc/do_tgs_req.c |
55 |
+@@ -204,6 +204,11 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt, |
56 |
+ status = "FIND_FAST"; |
57 |
+ goto cleanup; |
58 |
+ } |
59 |
++ if (sprinc == NULL) { |
60 |
++ status = "NULL_SERVER"; |
61 |
++ errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN; |
62 |
++ goto cleanup; |
63 |
++ } |
64 |
+ |
65 |
+ errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server, |
66 |
+ &local_tgt, &local_tgt_storage, &local_tgt_key); |
67 |
|
68 |
diff --git a/app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild b/app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild |
69 |
new file mode 100644 |
70 |
index 000000000000..cd2e67613dd3 |
71 |
--- /dev/null |
72 |
+++ b/app-crypt/mit-krb5/mit-krb5-1.19.2-r2.ebuild |
73 |
@@ -0,0 +1,165 @@ |
74 |
+# Copyright 1999-2022 Gentoo Authors |
75 |
+# Distributed under the terms of the GNU General Public License v2 |
76 |
+ |
77 |
+EAPI=8 |
78 |
+ |
79 |
+PYTHON_COMPAT=( python3_{8..10} ) |
80 |
+inherit autotools flag-o-matic multilib-minimal python-any-r1 systemd toolchain-funcs |
81 |
+ |
82 |
+MY_P="${P/mit-}" |
83 |
+P_DIR=$(ver_cut 1-2) |
84 |
+DESCRIPTION="MIT Kerberos V" |
85 |
+HOMEPAGE="https://web.mit.edu/kerberos/www/" |
86 |
+SRC_URI="https://web.mit.edu/kerberos/dist/krb5/${P_DIR}/${MY_P}.tar.gz" |
87 |
+ |
88 |
+LICENSE="openafs-krb5-a BSD MIT OPENLDAP BSD-2 HPND BSD-4 ISC RSA CC-BY-SA-3.0 || ( BSD-2 GPL-2+ )" |
89 |
+SLOT="0" |
90 |
+KEYWORDS="~alpha ~amd64 ~arm ~arm64 ~hppa ~ia64 ~mips ~ppc ~ppc64 ~riscv ~s390 ~sparc ~x86" |
91 |
+IUSE="cpu_flags_x86_aes doc +keyutils lmdb nls openldap +pkinit selinux +threads test xinetd" |
92 |
+ |
93 |
+# some tests requires network access |
94 |
+RESTRICT="test" |
95 |
+ |
96 |
+DEPEND=" |
97 |
+ !!app-crypt/heimdal |
98 |
+ || ( |
99 |
+ >=sys-fs/e2fsprogs-1.46.4-r51[${MULTILIB_USEDEP}] |
100 |
+ sys-libs/e2fsprogs-libs[${MULTILIB_USEDEP}] |
101 |
+ ) |
102 |
+ || ( |
103 |
+ >=dev-libs/libverto-0.2.5[libev,${MULTILIB_USEDEP}] |
104 |
+ >=dev-libs/libverto-0.2.5[libevent,${MULTILIB_USEDEP}] |
105 |
+ ) |
106 |
+ keyutils? ( >=sys-apps/keyutils-1.5.8:=[${MULTILIB_USEDEP}] ) |
107 |
+ lmdb? ( dev-db/lmdb ) |
108 |
+ nls? ( sys-devel/gettext[${MULTILIB_USEDEP}] ) |
109 |
+ openldap? ( >=net-nds/openldap-2.4.38-r1[${MULTILIB_USEDEP}] ) |
110 |
+ pkinit? ( >=dev-libs/openssl-1.0.1h-r2:0=[${MULTILIB_USEDEP}] ) |
111 |
+ xinetd? ( sys-apps/xinetd ) |
112 |
+ " |
113 |
+BDEPEND=" |
114 |
+ ${PYTHON_DEPS} |
115 |
+ virtual/yacc |
116 |
+ cpu_flags_x86_aes? ( |
117 |
+ amd64? ( dev-lang/yasm ) |
118 |
+ x86? ( dev-lang/yasm ) |
119 |
+ ) |
120 |
+ doc? ( virtual/latex-base ) |
121 |
+ test? ( |
122 |
+ ${PYTHON_DEPS} |
123 |
+ dev-lang/tcl:0 |
124 |
+ dev-util/dejagnu |
125 |
+ dev-util/cmocka |
126 |
+ )" |
127 |
+RDEPEND="${DEPEND} |
128 |
+ selinux? ( sec-policy/selinux-kerberos )" |
129 |
+ |
130 |
+S=${WORKDIR}/${MY_P}/src |
131 |
+ |
132 |
+PATCHES=( |
133 |
+ "${FILESDIR}/${PN}-1.12_warn_cflags.patch" |
134 |
+ "${FILESDIR}/${PN}-config_LDFLAGS-r1.patch" |
135 |
+ "${FILESDIR}/${PN}_dont_create_rundir.patch" |
136 |
+ "${FILESDIR}/${PN}-1.18.2-krb5-config.patch" |
137 |
+ "${FILESDIR}/${PN}-CVE-2021-37750.patch" |
138 |
+) |
139 |
+ |
140 |
+MULTILIB_CHOST_TOOLS=( |
141 |
+ /usr/bin/krb5-config |
142 |
+) |
143 |
+ |
144 |
+src_prepare() { |
145 |
+ default |
146 |
+ # Make sure we always use the system copies. |
147 |
+ rm -rf util/{et,ss,verto} |
148 |
+ sed -i 's:^[[:space:]]*util/verto$::' configure.ac || die |
149 |
+ |
150 |
+ eautoreconf |
151 |
+} |
152 |
+ |
153 |
+src_configure() { |
154 |
+ # QA |
155 |
+ append-flags -fno-strict-aliasing |
156 |
+ append-flags -fno-strict-overflow |
157 |
+ |
158 |
+ multilib-minimal_src_configure |
159 |
+} |
160 |
+ |
161 |
+multilib_src_configure() { |
162 |
+ ECONF_SOURCE=${S} \ |
163 |
+ AR="$(tc-getAR)" \ |
164 |
+ WARN_CFLAGS="set" \ |
165 |
+ econf \ |
166 |
+ $(use_with openldap ldap) \ |
167 |
+ "$(multilib_native_use_with test tcl "${EPREFIX}/usr")" \ |
168 |
+ $(use_enable nls) \ |
169 |
+ $(use_enable pkinit) \ |
170 |
+ $(use_enable threads thread-support) \ |
171 |
+ $(use_with lmdb) \ |
172 |
+ $(use_with keyutils) \ |
173 |
+ --without-hesiod \ |
174 |
+ --enable-shared \ |
175 |
+ --with-system-et \ |
176 |
+ --with-system-ss \ |
177 |
+ --enable-dns-for-realm \ |
178 |
+ --enable-kdc-lookaside-cache \ |
179 |
+ --with-system-verto \ |
180 |
+ --disable-rpath |
181 |
+} |
182 |
+ |
183 |
+multilib_src_compile() { |
184 |
+ emake -j1 |
185 |
+} |
186 |
+ |
187 |
+multilib_src_test() { |
188 |
+ multilib_is_native_abi && emake -j1 check |
189 |
+} |
190 |
+ |
191 |
+multilib_src_install() { |
192 |
+ emake \ |
193 |
+ DESTDIR="${D}" \ |
194 |
+ EXAMPLEDIR="${EPREFIX}/usr/share/doc/${PF}/examples" \ |
195 |
+ install |
196 |
+} |
197 |
+ |
198 |
+multilib_src_install_all() { |
199 |
+ # default database dir |
200 |
+ keepdir /var/lib/krb5kdc |
201 |
+ |
202 |
+ cd .. |
203 |
+ dodoc README |
204 |
+ |
205 |
+ if use doc; then |
206 |
+ dodoc -r doc/html |
207 |
+ docinto pdf |
208 |
+ dodoc doc/pdf/*.pdf |
209 |
+ fi |
210 |
+ |
211 |
+ newinitd "${FILESDIR}"/mit-krb5kadmind.initd-r2 mit-krb5kadmind |
212 |
+ newinitd "${FILESDIR}"/mit-krb5kdc.initd-r2 mit-krb5kdc |
213 |
+ newinitd "${FILESDIR}"/mit-krb5kpropd.initd-r2 mit-krb5kpropd |
214 |
+ newconfd "${FILESDIR}"/mit-krb5kadmind.confd mit-krb5kadmind |
215 |
+ newconfd "${FILESDIR}"/mit-krb5kdc.confd mit-krb5kdc |
216 |
+ newconfd "${FILESDIR}"/mit-krb5kpropd.confd mit-krb5kpropd |
217 |
+ |
218 |
+ systemd_newunit "${FILESDIR}"/mit-krb5kadmind.service mit-krb5kadmind.service |
219 |
+ systemd_newunit "${FILESDIR}"/mit-krb5kdc.service mit-krb5kdc.service |
220 |
+ systemd_newunit "${FILESDIR}"/mit-krb5kpropd.service mit-krb5kpropd.service |
221 |
+ systemd_newunit "${FILESDIR}"/mit-krb5kpropd_at.service "mit-krb5kpropd@.service" |
222 |
+ systemd_newunit "${FILESDIR}"/mit-krb5kpropd.socket mit-krb5kpropd.socket |
223 |
+ |
224 |
+ insinto /etc |
225 |
+ newins "${ED}/usr/share/doc/${PF}/examples/krb5.conf" krb5.conf.example |
226 |
+ insinto /var/lib/krb5kdc |
227 |
+ newins "${ED}/usr/share/doc/${PF}/examples/kdc.conf" kdc.conf.example |
228 |
+ |
229 |
+ if use openldap ; then |
230 |
+ insinto /etc/openldap/schema |
231 |
+ doins "${S}/plugins/kdb/ldap/libkdb_ldap/kerberos.schema" |
232 |
+ fi |
233 |
+ |
234 |
+ if use xinetd ; then |
235 |
+ insinto /etc/xinetd.d |
236 |
+ newins "${FILESDIR}/kpropd.xinetd" kpropd |
237 |
+ fi |
238 |
+} |