CVE-2022-45142
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a...
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
CVE-2022-45142- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-354
- Updated
- 2026-11-02
CVE List
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
CVE-2022-45142- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-354
- Updated
- 2026-11-02
EUVDEUVD-2022-48057
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
EUVD-2022-48057- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5gp7-pf54-xc33
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a...
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
GHSA-5gp7-pf54-xc33- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-354
- Updated
- 2026-11-02
OSVALPINE-CVE-2022-45142
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
ALPINE-CVE-2022-45142- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-03
OSVAZL-25604
CVE-2022-45142 affecting package heimdal for versions less than 7.7.1-2
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
AZL-25604- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
Show 8 moreShow less
OSVAZL-34797
CVE-2022-45142 affecting package heimdal for versions less than 7.8.0-3
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
AZL-34797- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-05
OSVBELL-CVE-2022-45142
CVE-2022-45142 does not affect BellSoft software
- Record
BELL-CVE-2022-45142- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSV
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
CVE-2022-45142- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-354
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-45142
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
UBUNTU-CVE-2022-45142- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-45142 No score
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported to the heimdal-7.7.1 and heimdal-7.8.0 branches (and possibly other branches) a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted.
- Record
DEBIAN-CVE-2022-45142- Updated
- 2026-11-03
OSVMGASA-2023-0098 No score
Updated heimdal packages fix security vulnerability
The fix for CVE-2022-3437 included changing memcmp to be constant time and a workaround for a compiler bug by adding "!= 0" comparisons to the result of memcmp. When these patches were backported a logic inversion sneaked in causing the validation of message integrity codes in gssapi/arcfour to be inverted. (CVE-2022-45142)
- Record
MGASA-2023-0098- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12846-1 No score
libasn1-8-7.8.0-3.1 on GA media
These are all security issues fixed in the libasn1-8-7.8.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12846-1- Updated
- 2026-11-02
OSVUSN-5849-1 No score
heimdal vulnerabilities
Helmut Grohne discovered that Heimdal GSSAPI incorrectly handled logical conditions that are related to memory management operations. An attacker could possibly use this issue to cause a denial of service.
- Record
USN-5849-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
heimdalAlpine:v3.14 |
before 7.7.1-r1 | 7.7.1-r1 |
heimdalAlpine:v3.15 |
before 7.7.1-r0 | 7.7.1-r0 |
heimdalAlpine:v3.16 |
before 7.7.1-r0 | 7.7.1-r0 |
heimdalAlpine:v3.17 |
before 7.8.0-r1 | 7.8.0-r1 |
heimdalAlpine:v3.18 |
before 7.8.0-r2 | 7.8.0-r2 |
heimdalAlpine:v3.19 |
before 7.8.0-r2 | 7.8.0-r2 |
heimdalAlpine:v3.20 |
before 7.8.0-r2 | 7.8.0-r2 |
heimdalAlpine:v3.21 |
before 7.8.0-r2 | 7.8.0-r2 |
heimdalAlpine:v3.22 |
before 7.8.0-r2 | 7.8.0-r2 |
heimdalAlpine:v3.23 |
before 7.8.0-r2 | 7.8.0-r2 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
heimdalAlpine:v3.24 |
before 7.8.0-r2 | 7.8.0-r2 |
heimdalAzure Linux:2 |
before 7.7.1-2 | 7.7.1-2 |
heimdalAzure Linux:3 |
before 7.8.0-3 | 7.8.0-3 |
heimdalDebian:12 |
before 7.8.git20221117.28daf24+dfsg-1.1 | 7.8.git20221117.28daf24+dfsg-1.1 |
heimdalDebian:13 |
before 7.8.git20221117.28daf24+dfsg-1.1 | 7.8.git20221117.28daf24+dfsg-1.1 |
heimdalDebian:14 |
before 7.8.git20221117.28daf24+dfsg-1.1 | 7.8.git20221117.28daf24+dfsg-1.1 |
heimdalDebian:10 |
before 7.5.0+dfsg-3+deb10u2, plus listed versions 7.5.0+dfsg-37.5.0+dfsg-3+deb10u1 |
7.5.0+dfsg-3+deb10u2 |
heimdalDebian:11 |
before 7.7.0+dfsg-2+deb11u3, plus listed versions 7.7.0+dfsg-27.7.0+dfsg-2+deb11u17.7.0+dfsg-2+deb11u2 |
7.7.0+dfsg-2+deb11u3 |
heimdalMageia:8 |
before 7.7.1-1.3.mga8 | 7.7.1-1.3.mga8 |
heimdalUbuntu:Pro:14.04:LTS |
before 1.6~git20131207+dfsg-1ubuntu1.2+esm4, plus listed versions 1.6~git20120403+dfsg1-3ubuntu0.11.6~git20120403+dfsg1-3ubuntu0.21.6~git20131207+dfsg-1ubuntu11.6~git20131207+dfsg-1ubuntu1.11.6~git20131207+dfsg-1ubuntu1.21.6~git20131207+dfsg-1ubuntu1.2+esm11.6~git20131207+dfsg-1ubuntu1.2+esm21.6~git20131207+dfsg-1ubuntu1.2+esm3 |
1.6~git20131207+dfsg-1ubuntu1.2+esm4 |
heimdalUbuntu:Pro:16.04:LTS |
before 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm4, plus listed versions 1.6~rc2+dfsg-10ubuntu11.7~git20150920+dfsg-4ubuntu11.7~git20150920+dfsg-4ubuntu1.16.04.11.7~git20150920+dfsg-4ubuntu1.16.04.1+esm11.7~git20150920+dfsg-4ubuntu1.16.04.1+esm21.7~git20150920+dfsg-4ubuntu1.16.04.1+esm3 |
1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm4 |
heimdalUbuntu:18.04:LTS |
before 7.5.0+dfsg-1ubuntu0.4, plus listed versions 7.4.0.dfsg.1-27.5.0+dfsg-17.5.0+dfsg-1ubuntu0.17.5.0+dfsg-1ubuntu0.27.5.0+dfsg-1ubuntu0.3 |
7.5.0+dfsg-1ubuntu0.4 |
heimdalUbuntu:20.04:LTS |
before 7.7.0+dfsg-1ubuntu1.4, plus listed versions 7.5.0+dfsg-3build17.7.0+dfsg-17.7.0+dfsg-1ubuntu17.7.0+dfsg-1ubuntu1.17.7.0+dfsg-1ubuntu1.27.7.0+dfsg-1ubuntu1.3 |
7.7.0+dfsg-1ubuntu1.4 |
heimdalUbuntu:22.04:LTS |
All versions, plus listed versions 7.7.0+dfsg-2ubuntu27.7.0+dfsg-3ubuntu1 |
None known |
heimdalUbuntu:24.04:LTS |
All versions, plus listed versions 7.8.git20221117.28daf24+dfsg-3ubuntu17.8.git20221117.28daf24+dfsg-3ubuntu27.8.git20221117.28daf24+dfsg-3ubuntu37.8.git20221117.28daf24+dfsg-3ubuntu47.8.git20221117.28daf24+dfsg-4ubuntu17.8.git20221117.28daf24+dfsg-5ubuntu27.8.git20221117.28daf24+dfsg-5ubuntu3 |
None known |
heimdalUbuntu:25.10 |
All versions, plus listed versions 7.8.git20221117.28daf24+dfsg-9ubuntu1 |
None known |
heimdalUbuntu:26.10 |
All versions, plus listed versions 7.8.git20221117.28daf24+dfsg-11ubuntu17.8.git20221117.28daf24+dfsg-12ubuntu17.8.git20240113.1b4565a+dfsg-1ubuntu17.8.git20240113.1b4565a+dfsg-1ubuntu27.8.git20240113.1b4565a+dfsg-2ubuntu1 |
None known |
heimdalUbuntu:26.04:LTS |
All versions, plus listed versions 7.8.git20221117.28daf24+dfsg-9ubuntu17.8.git20221117.28daf24+dfsg-10ubuntu17.8.git20221117.28daf24+dfsg-11ubuntu1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-45142 is a high vulnerability (CVSS 7.5) in Heimdal Project Heimdal, published February 8, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.49%, the 42nd percentile. Fixed in heimdal 7.7.1-r1.
References
openwall.com/lists/oss-security/2023/02/08/1
security.gentoo.org/glsa/202310-06
nvd.nist.gov/vuln/detail/CVE-2022-45142
github.com/advisories/GHSA-5gp7-pf54-xc33
security.alpinelinux.org/vuln/CVE-2022-45142
docs.bell-sw.com/security/cves/CVE-2022-45142
Show 9 moreShow less
security-tracker.debian.org/tracker/CVE-2022-45142
advisories.mageia.org/MGASA-2023-0098.html
bugs.mageia.org/show_bug.cgi?id=31530
debian.org/security/2023/dsa-5344
ubuntu.com/security/notices/USN-5849-1
cve.org/CVERecord?id=CVE-2022-45142
suse.com/security/cve/CVE-2022-45142