CVE-2019-12098

NameCVE-2019-12098
DescriptionIn the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-4455-1
Debian Bugs929064

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
heimdal (PTS)jessie, jessie (lts)1.6~rc2+dfsg-9+deb8u3vulnerable
stretch (security)7.1.0+dfsg-13+deb9u3fixed
stretch (lts), stretch7.1.0+dfsg-13+deb9u4fixed
buster (security), buster, buster (lts)7.5.0+dfsg-3+deb10u2fixed
bullseye (security), bullseye7.7.0+dfsg-2+deb11u3fixed
bookworm7.8.git20221117.28daf24+dfsg-2fixed
sid, trixie7.8.git20221117.28daf24+dfsg-8fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
heimdalsourcestretch7.1.0+dfsg-13+deb9u3DSA-4455-1
heimdalsource(unstable)7.5.0+dfsg-3929064

Notes

Fixed by: https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf (7.6.0)
Introduced by: https://github.com/heimdal/heimdal/commit/a1ef548600c5bb51cf52a9a9ea12676506ede19f (1.4.0)
[jessie] - heimdal <ignored> (jessie's heimdal anonymous pkinit implementation is significantly different to later releases that issued tickets do not pass the additional validation added by the fix. In particular, the required PKINIT-KX reponse is missing and thus validation fails. This is rectified in https://github.com/heimdal/heimdal/pull/110. As such, this is a breaking change on a networked application. We recommend disabling anonymous tickets on relevant KDCs.)

Search for package or bug name: Reporting problems