PatchTheCVEheimdal vulnerabilities and fixes
Recent CVEs affecting heimdal, with upgrade or downgrade steps. 6 tracked.
heimdal has 6 tracked vulnerabilities, 1 critical. A fixed release or vendor patch exists for 5. Most recent: 2023-03-27. Highest priority: CVE-2022-44640 (score 60/100).
- CVE-2022-42898 HIGH 8.8 UPGRADE UPGRADE PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may
- CVE-2022-45142 HIGH 7.5 DOWNGRADE The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by
- CVE-2022-44640 CRITICAL 9.8 UPGRADE UPGRADE Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1
- CVE-2022-41916 MEDIUM 5.9 UPGRADE MITIGATE Heimdal is an implementation of ASN.1/DER, PKIX, and Kerberos
- CVE-2022-3116 HIGH 7.5 UPGRADE The Heimdal Software Kerberos 5 implementation is vulnerable to a null pointer dereferance
- CVE-2021-44758 HIGH 7.5 UPGRADE Heimdal before 7.7.1 allows attackers to cause a NULL pointer dereference in a SPNEGO acceptor via a preferred
FAQ
How do I fix heimdal vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is heimdal being exploited right now?
None of the tracked heimdal CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which heimdal CVE should I patch first?
CVE-2022-44640 currently ranks highest (60/100): Heimdal before 7.7.1 allows remote attackers to execute arbitrary code because of an invalid free in the ASN.1.