Permalink
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
Fix KDC null deref on TGS inner body null server
After the KDC decodes a FAST inner body, it does not check for a null server. Prior to commit 39548a5 this would typically result in an error from krb5_unparse_name(), but with the addition of get_local_tgt() it results in a null dereference. Add a null check. Reported by Joseph Sutton of Catalyst. CVE-2021-37750: In MIT krb5 releases 1.14 and later, an authenticated attacker can cause a null dereference in the KDC by sending a FAST TGS request with no server field. ticket: 9008 (new) tags: pullup target_version: 1.19-next target_version: 1.18-next
- Loading branch information