upstream/opnsense-src
1
0
Fork 0
mirror of https://github.com/opnsense/src.git synced 2026-03-12 05:32:15 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions
opnsense-src/crypto
History
Cy Schubert 5b7c923d95 heimdal: Fix NULL deref 
A flawed logical condition allows a malicious actor to remotely
trigger a NULL pointer dereference using a crafted negTokenInit
token.

Upstream notes:

    Reported to Heimdal by Michał Kępień <michal@isc.org>.

    From the report:

    Acknowledgement
    ---------------

    This flaw was found while working on addressing ZDI-CAN-12302: ISC BIND
    TKEY Query Heap-based Buffer Overflow Remote Code Execution
    Vulnerability, which was reported to ISC by Trend Micro's Zero Day

Security:	CVE-2022-3116
Obtained from:	upstream 7a19658c1

(cherry picked from commit fc773115fa2dbb6c01377f2ed47dabf79a4e361a)
2024-02-21 05:42:58 -08:00
..
heimdal heimdal: Fix NULL deref 2024-02-21 05:42:58 -08:00
openssh ssh: Update to OpenSSH 9.6p1 2024-01-07 14:31:11 -05:00
openssl OpenSSL: Update date string 2024-02-07 16:48:50 -08:00
README Two more $FreeBSD$ stragglers 2023-09-17 08:34:41 -06:00

README 

This directory is for the EXACT same use as src/contrib, except it
holds crypto sources.  In other words, this holds raw sources obtained
from various third party vendors, with FreeBSD patches applied.  No
compilation is done from this directory, it is all done from the
src/secure directory.  The separation between src/contrib and src/crypto
is the result of an old USA law, which made these sources export
controlled, so they had to be kept separate.