已关闭
Fix CVE-2024-3596 in krb5 for 22.03 SP3 #307
Fix CVE-2024-3596 in krb5 for 22.03 SP3 #307
已关闭
jixiang创建于 7月10日关闭于 1 天前
jixiang
jixiang
7月10日

Backport the existing openEuler krb5 CVE-2024-3596 fix to openEuler-22.03-LTS-SP3.

openEuler CVE status:

  • Package: krb5
  • CVE: CVE-2024-3596
  • openEuler/NVD score: 9.0
  • Affected branch: openEuler-22.03-LTS-SP3

Fix:

  • Add backport-CVE-2024-3596.patch from the fixed openEuler 24.03 krb5 branch.
  • Apply it from krb5.spec and bump the package release.
  • The patch generates and verifies RADIUS Message-Authenticator MACs in libkrad, mitigating the BlastRADIUS/RFC 2865 response forgery issue.

Validation:

  • Confirmed openEuler-22.03-LTS-SP3 lacks backport-CVE-2024-3596.patch before this MR.
  • Confirmed the same patch is present in fixed openEuler krb5 branches.
  • Verified the patch applies cleanly to the openEuler-22.03-LTS-SP3 source tree with patch -p1 --dry-run.

Signed-off-by: Ji Xiang qfmy_250803@qq.com

likedislike
当前Pull Request已关闭, 关闭人@openeuler-ci-bot
jixiangjixiang
7月10日 创建了 pull request,commit 576da88c
openeuler-ci-botopeneuler-ci-bot成员
7月10日 将licihua,dillon_chen,overweight,zhujianwei001,shenyangyang设为审查人
openeuler-ci-botopeneuler-ci-bot成员
7月10日 添加了label:sig/Base-service
openeuler-ci-bot
openeuler-ci-bot成员
7月10日 评论:

Welcome To openEuler Community

Hey @gca_u2301_82052726 , thanks for your contribution to the community.

Bot Usage Manual

I'm the Bot here serving you. You can find the instructions on how to interact with me at Here . That means you can comment below every pull request or issue to trigger Bot Commands.

Contact Guide

If you have any questions, please contact the SIG: Base-service ,
and any of the maintainers: @dillon_chen, @licihua, @overweight, @shenyangyang, @zhujianwei001 ,
and any of the committers: @houmingyong, @jiayi0118, @qq_28851361 .

likedislike
openeuler-ci-botopeneuler-ci-bot成员
7月10日 添加了label:stat/needs-squash
此处折叠了92条消息 查看更多
openeuler-ci-botopeneuler-ci-bot成员
7月13日 添加了label:ci_successful
openeuler-ci-bot
openeuler-ci-bot成员
7月13日 评论:

如下为接口变更检查结果,目标分支为openEuler-22.03-LTS-SP3,请PR提交者check差异信息

Arch Name Check Items Rpm Name Check Result Build Details
compare_package(x86_64) add_rpms ✅SUCCESS #66
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_cmd ✅SUCCESS
rpm_config ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_service ✅SUCCESS
rpm_symbol ✅SUCCESS
compare_package(aarch64) add_rpms ✅SUCCESS #66
delete_rpms ✅SUCCESS
rpm_abi ✅SUCCESS
rpm_cmd ✅SUCCESS
rpm_config ✅SUCCESS
rpm_files ✅SUCCESS
rpm_header ✅SUCCESS
rpm_lib ✅SUCCESS
rpm_provides ✅SUCCESS
rpm_requires ✅SUCCESS
rpm_service ✅SUCCESS
rpm_symbol ✅SUCCESS
likedislike
openeuler-ci-bot
openeuler-ci-bot成员
7月13日 评论:
likedislike
陈棋德
陈棋德成员
1 天前 评论:

/close

likedislike
openeuler-ci-botopeneuler-ci-bot成员
1 天前 关闭了 pull request