CVE-2022-42898

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2022-42898
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42898.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2022-42898
Aliases
  • GHSA-64mq-fvfj-5x3c
Downstream
ALPINE (1)
AZL (3)
BELL (1)
CLEANSTART (1)
CLSA (9)
DEBIAN (1)
ECHO (1)
JLSEC (1)
MGASA (3)
OESA (1)
openSUSE (5)
RHEA (1)
RHSA (10)
RLSA (2)
SUSE (9)
UBUNTU (1)
Related
ALSA (2)
openSUSE (5)
SUSE (9)
Published
2022-12-25T00:00:00Z
Modified
2026-10-22T07:44:20Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/42xxx/CVE-2022-42898.json"
}
References

Affected packages

Git / github.com/heimdal/heimdal

Affected ranges

Type
GIT
Repo
https://github.com/heimdal/heimdal
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
78077c39e355766221383ee48c8b9be0459a82a4
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "7.7.1"
                }
            ],
            "source":  "DESCRIPTION"
        },
        {
            "cpe":  "cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "7.7.1"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}
Type
GIT
Repo
https://github.com/krb5/krb5
Events
Introduced
83758c28e976230ce11df1db51ccee7166b89110
Fixed
638554a15de7165b004c815124aa6145f98d0598
Introduced
fea39a0daeed8720b5c6fe095a81d8ca158351d2
Fixed
ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.8"
                },
                {
                    "fixed":  "1.19.4"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "cpe":  "cpe:2.3:a:mit:kerberos_5:1.20:-:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.20-NA"
                },
                {
                    "last_affected":  "1.20-NA"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "cpe":  "cpe:2.3:a:mit:kerberos_5:1.20:beta1:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "1.20-beta1"
                },
                {
                    "last_affected":  "1.20-beta1"
                }
            ],
            "source":  "CPE_STRING"
        },
        {
            "range":  [
                {
                    "fixed":  "ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

1.*
1.20-NA
1.20-beta1
Other
git2svn-syncpoint-master
switch-from-svn-to-git
heimdal-1.*
heimdal-1.3.0pre1
heimdal-1.3.0pre10
heimdal-1.3.0pre11
heimdal-1.3.0pre3
heimdal-1.3.0pre4
heimdal-1.3.0pre5
heimdal-1.3.0pre6
heimdal-1.3.0pre7
heimdal-1.3.0pre8
heimdal-1.3.0pre9
heimdal-1.3.0rc1
heimdal-1.5pre1
heimdal-1.5pre2
heimdal-7.*
heimdal-7.0.1
heimdal-7.0.2
heimdal-7.0.3
heimdal-7.1.0
heimdal-7.1rc1
heimdal-7.2.0
heimdal-7.3.0
heimdal-7.4.0
heimdal-7.5.0
heimdal-7.6.0
heimdal-7.7.0
upstream-1.*
upstream-1.4.0+git20101228.dfsg.1
upstream-1.4.0+git20110220.dfsg.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2022-42898.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "313212553996591129015720005043578260600",
            "length":  8101
        },
        "id":  "CVE-2022-42898-190ec2e6",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583",
        "target":  {
            "file":  "src/lib/krb5/krb/t_pac.c",
            "function":  "main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "47415333018243679864646462913306600925",
                "113522990652075189899911575550870172940",
                "332636347402384035849490568060121070816",
                "24974974711904770793287531419649756654",
                "34036481326062071104848288339706052122",
                "335906234459261617987938532306053980177",
                "154732096699152609497200721234291993685",
                "185833400480707633037073703290605393751",
                "114563188656008062785041387091874740449",
                "258667828208263873189321892773311252565",
                "259921342012297268374246674019195512093"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-42898-1a970be7",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583",
        "target":  {
            "file":  "src/lib/krb5/krb/pac.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "203158983188195784883759796692003894593",
                "117811727424344157626574231154516038039",
                "275952240584579959483060309342236230792",
                "87998220430651193888088689122468582815",
                "198618692815112439499828060074676714596",
                "86990030903086973170313960916416642456"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-42898-705fc6fd",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583",
        "target":  {
            "file":  "src/lib/krb5/krb/t_pac.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "185684756605390238103334007784352789624",
                "7131579695216385856922531758292910060",
                "96067565823201056646313325968740529266",
                "307324062224806380958204996069287421659"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2022-42898-7e74d481",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/heimdal/heimdal/commit/78077c39e355766221383ee48c8b9be0459a82a4",
        "target":  {
            "file":  "include/bits.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "141063196662638433845114500023813850879",
            "length":  1490
        },
        "id":  "CVE-2022-42898-d3714872",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583",
        "target":  {
            "file":  "src/lib/krb5/krb/pac.c",
            "function":  "krb5_pac_parse"
        }
    }
]
vanir_signatures_modified 
"2026-10-22T07:44:20Z"