Bug 276775 - security/heimdal: Update to 7.8 or newer version
Summary: security/heimdal: Update to 7.8 or newer version
Status: New
Alias: None
Product: Ports & Packages
Classification: Unclassified
Component: Individual Port(s) (show other bugs)
Version: Latest
Hardware: Any Any
: --- Affects Many People
Assignee: Hiroki Sato
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2024-02-02 08:43 UTC by ChenHao Lu
Modified: 2024-04-06 11:32 UTC (History)
0 users

See Also:
bugzilla: maintainer-feedback? (hrs)

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description ChenHao Lu 2024-02-02 08:43:32 UTC 
CVE-2020-10188 is a security vulnerability in telnetd. As https://github.com/freebsd/freebsd-src/commit/5760cb266e0ab04c221c2acdb4b6c4c141130ecd said, freebsd has fixed this CVE in contrib/telnet/telnetd/utility.c. However, I've found that in heimdal, which is used in ravynos to encrypt and decrypt, also uses telnetd. That is to say freebsd may still contains this security vulnerability which will result in arbitrary code execution. The file which contains vulnerable functions is crypto/heimdal/appl/telnet/telnetd/utility.c.
Update the heimdal to 7.8 or a newer verison may help to solve this, since heimdal had already remove telnet support in https://github.com/heimdal/heimdal/commit/e55b0d0ca5038a8101276a593ffbb6be4c27c8d0.
Comment 1 Andrey Korobkov 2024-03-27 19:02:45 UTC 
The latest heimdal available is 7.8 for now and it is already in the port tree since 83f79ba0e0ca (2022-11-15).
Comment 2 ChenHao Lu 2024-03-31 04:18:28 UTC 
(In reply to Andrey Korobkov from comment #1)
That's true, but I'm talking about heimdal which is used in the crypto path(https://github.com/freebsd/freebsd-src/tree/783d3ff6d7fae619db8a7990b8a6387de0c677b5/crypto/heimdal). The lastest version on GitHub shows that the heimdal in the crypto path is still an outdated version(1.5.2).
Comment 3 Andrey Korobkov 2024-04-01 07:40:29 UTC 
Aah. Sorry then. I thought about one in the ports. (Didn't know about one in the base).