HIGH 7.5 Microsoft

CVE-2022-45142

The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.

Microsoft Security Update 2023-Mar: The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.

Affected Products

References

Published: 2023-03-14 · Source: Microsoft · Feed updated: 2026-09-17
This high severity vulnerability with a CVSS score of 7.5 was published on 2023-03-14 via Microsoft. Affected: cm1 heimdal 7.7.1-2 on CBL Mariner 1.0, cbl2 heimdal 7.7.1-2 on CBL Mariner 2.0, azl3 heimdal 7.8.0-3 on Azure Linux 3.0.
vulnfeed aggregates 8294 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.