Publicus/cvefixes-security-ir-graphrag huggingface dataset:
CVE-2023-3075: Cross-Site Request Forgery (CSRF) (CWE-352)
value: Cross-Site Request Forgery (CSRF) in GitHub repository tsolucio/corebos prior to 8.
CWE description: The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.
CVSS v3 base score: 6.5
Published: 2023-06-02T18:15Z
Repository: https://github.com/tsolucio/corebos
Language: PHP
Files changed: Smarty/templates/modules/Utilities/2fa.tpl, include/integrations/2fa/settings.php
Commit date: 2023-06-02 19:04:59 +0200
Commit message: sec(2FA) apply CSRF check

Diff: diff --git a/Smarty/templates/modules/Utilities/2fa.tpl b/Smarty/templates/modules/Utilities/2fa.tpl
index 80db5f91009..498a0e18735 100644
--- a/Smarty/templates/modules/Utilities/2fa.tpl
+++ b/Smarty/templates/modules/Utilities/2fa.tpl
@@ -11,11 +11,11 @@
 		</div>
 		</h2>
 	</header>
 	<div class="slds-modal__content slds-app-launcher__content slds-p-around_medium">
 		{include file='applicationmessage.tpl'}
-		<form role="form" style="margin:0 100px;" name="faform">
+		<form role="form" style="margin:0 100px;" name="faform" method="post">
 		<input type="hidden" name="module" value="Utilities">
 		<input type="hidden" name="action" value="integration">
 		<input type="hidden" name="_op" id="_op" value="setconfig2fa">
 		<header>
 			<div class="slds-form-element slds-lookup" data-select="single" style="width: 400px; margin-bottom: 6px;">
diff --git a/include/integrations/2fa/settings.php b/include/integrations/2fa/settings.php
index f481b2eff64..de136348b24 100644
--- a/include/integrations/2fa/settings.php
+++ b/include/integrations/2fa/settings.php
@@ -25,10 +25,11 @@ $smarty = new vtigerCRM_Smarty();
 $isPermitted = isPermitted('GlobalVariable', 'EditView');
 $userid = isset($_REQUEST['user_list']) ? vtlib_purify($_REQUEST['user_list']) : '';
 $do2FA = GlobalVariable::getVariable('User_2FAAuthentication', 0, 'Users', $userid);
 $isAppActive = ($do2FA==1);
 if (!empty($userid) && $_REQUEST['_op']=='setconfig2fa' && $isPermitted=='yes') {
+	Vtiger_Request::validateRequest();
 	$isFormActive = ((empty($_REQUEST['2faactive']) || $_REQUEST['2faactive']!='on') ? '0' : '1');
 	$crmEntityTable = CRMEntity::getcrmEntityTableAlias('GlobalVariable');
 	$recexists = $adb->pquery(
 		'select globalvariableid from vtiger_globalvariable inner join '.$crmEntityTable.' on crmid=globalvariableid where deleted=0 and gvname=? and smownerid=?',
 		array('User_2FAAuthentication', $userid)

Vulnerable code: 		<form role="form" style="margin:0 100px;" name="faform">
Fixed code: 		<form role="form" style="margin:0 100px;" name="faform" method="post">
	Vtiger_Request::validateRequest();
CVE-2024-26484: Insufficient Information (NVD-CWE-noinfo)
value: A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field. NOTE: the vendor's position is that this issue did not affect any version of Kirby CMS. The only effect was on the trykirby.com demo site, which is not customer-controlled.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-02-22T05:15Z
Repository: https://github.com/getkirby/demokit
Language: PHP
Files changed: site/snippets/blocks/image.php
Commit date: 2024-02-17 16:59:28 +0100
Commit message: Update image block to core snippet

Diff: diff --git a/site/snippets/blocks/image.php b/site/snippets/blocks/image.php
index ffe39b2..8adbc45 100644
--- a/site/snippets/blocks/image.php
+++ b/site/snippets/blocks/image.php
@@ -25,11 +25,11 @@ if ($ratio !== 'auto') {
 
 $attrs = attr([
   'class'         => $class,
   'data-contain'  => $contain,
   'data-lightbox' => $lightbox,
-  'href'          => $link->or($src),
+  'href'          => $link->or($src)->toUrl(),
   'style'         => '--w:' . $w . '; --h:' . $h,
 ]);
 
 ?>
 <?php if ($srcValue): ?>

Vulnerable code:   'href'          => $link->or($src),
Fixed code:   'href'          => $link->or($src)->toUrl(),
CVE-2020-35774: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: server/handler/HistogramQueryHandler.scala in Twitter TwitterServer (aka twitter-server) before 20.12.0, in some configurations, allows XSS via the /histograms endpoint.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2020-12-29T18:15Z
Repository: https://github.com/twitter/twitter-server
Language: Other
Files changed: CHANGELOG.rst, server/src/main/scala/com/twitter/server/handler/HistogramQueryHandler.scala
Commit date: 2020-11-10 18:45:51 +0000
Commit message: twitter-server: Plug XSS vulnerability in /histograms endpoint

Problem

Right now we allow script injection in /histograms by telling people about the
query that they just ran.

Solution

Stop telling people about the query they ran.

JIRA Issues: OSS-5328

Differential Revision: https://phabricator.twitter.biz/D574844

Diff: diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index df6b53c..6ed485a 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -5,10 +5,13 @@
 Note that ``PHAB_ID=#`` and ``RB_ID=#`` correspond to associated messages in commits.
 
 Unreleased
 ----------
 
+* Escape user-provided string from the returned text.  This removes a potential vector for an XSS
+  attack. ``PHAB_ID=D574844``
+
 20.10.0
 -------
 
 No Changes
 
diff --git a/server/src/main/scala/com/twitter/server/handler/HistogramQueryHandler.scala b/server/src/main/scala/com/twitter/server/handler/HistogramQueryHandler.scala
index bf87e6e..951c255 100644
--- a/server/src/main/scala/com/twitter/server/handler/HistogramQueryHandler.scala
+++ b/server/src/main/scala/com/twitter/server/handler/HistogramQueryHandler.scala
@@ -196,11 +196,11 @@ private[server] class HistogramQueryHandler(details: WithHistogramDetails)
     newResponse(
       contentType = ContentTypeJson,
       content = {
         val text = histograms.get(query) match {
           case Some(h) => transform(h.counts)
-          case None => s"Key: $query is not a valid histogram."
+          case None => s"Key: ${escapeHtml(query)} is not a valid histogram."
         }
         Buf.Utf8(text)
       }
     )
 
@@ -278,11 +278,11 @@ private[server] class HistogramQueryHandler(details: WithHistogramDetails)
       contentType = ContentTypeHtml,
       content = Buf.Utf8 {
         if (histograms.contains(query))
           render
         else
-          s"Key: $query is not a valid histogram."
+          s"Key: ${escapeHtml(query)} is not a valid histogram."
       }
     )
 
   /**
    * Handles requests for all histograms (/admin/histogram.json)

Vulnerable code:           case None => s"Key: $query is not a valid histogram."
          s"Key: $query is not a valid histogram."
Fixed code: * Escape user-provided string from the returned text.  This removes a potential vector for an XSS
  attack. ``PHAB_ID=D574844``

          case None => s"Key: ${escapeHtml(query)} is not a valid histogram."
          s"Key: ${escapeHtml(query)} is not a valid histogram."
CVE-2021-3765: Inefficient Regular Expression Complexity (CWE-1333)
value: validator.js is vulnerable to Inefficient Regular Expression Complexity
CWE description: The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CVSS v3 base score: 7.5
Published: 2021-11-02T07:15Z
Repository: https://github.com/validatorjs/validator.js
Language: JavaScript
Files changed: src/lib/rtrim.js
Commit date: 2021-11-01 23:30:39 +0300
Commit message: fix(rtrim): remove regex to prevent ReDOS attack (#1738)


Diff: diff --git a/src/lib/rtrim.js b/src/lib/rtrim.js
index d10aaa9..2d31157 100644
--- a/src/lib/rtrim.js
+++ b/src/lib/rtrim.js
@@ -1,8 +1,17 @@
 import assertString from './util/assertString';
 
 export default function rtrim(str, chars) {
   assertString(str);
-  // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
-  const pattern = chars ? new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g') : /(\s)+$/g;
-  return str.replace(pattern, '');
+  if (chars) {
+    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
+    const pattern = new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g');
+    return str.replace(pattern, '');
+  }
+  // Use a faster and more safe than regex trim method https://blog.stevenlevithan.com/archives/faster-trim-javascript
+  let strIndex = str.length - 1;
+  while (/\s/.test(str.charAt(strIndex))) {
+    strIndex -= 1;
+  }
+
+  return str.slice(0, strIndex + 1);
 }

Vulnerable code:   // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
  const pattern = chars ? new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g') : /(\s)+$/g;
  return str.replace(pattern, '');
Fixed code:   if (chars) {
    // https://developer.mozilla.org/en-US/docs/Web/JavaScript/Guide/Regular_Expressions#Escaping
    const pattern = new RegExp(`[${chars.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}]+$`, 'g');
    return str.replace(pattern, '');
  }
  // Use a faster and more safe than regex trim method https://blog.stevenlevithan.com/archives/faster-trim-javascript
  let strIndex = str.length - 1;
  while (/\s/.test(str.charAt(strIndex))) {
    strIndex -= 1;
  }

  return str.slice(0, strIndex + 1);
CVE-2020-11051: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: In Wiki.js before 2.3.81, there is a stored XSS in the Markdown editor. An editor with write access to a page, using the Markdown editor, could inject an XSS payload into the content. If another editor (with write access as well) load the same page into the Markdown editor, the XSS payload will be executed as part of the preview panel. The rendered result does not contain the XSS payload as it is stripped by the HTML Sanitization security module. This vulnerability only impacts editors loading the malicious page in the Markdown editor. This has been patched in 2.3.81.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 4.8
Published: 2020-05-05T21:15Z
Repository: https://github.com/Requarks/wiki
Language: JSON
Files changed: client/components/editor/editor-markdown.vue, package.json
Commit date: 2020-05-01 00:55:31 -0400
Commit message: fix: sanitize markdown preview on content change

Diff: diff --git a/client/components/editor/editor-markdown.vue b/client/components/editor/editor-markdown.vue
index cda89bbc..4385e2bd 100644
--- a/client/components/editor/editor-markdown.vue
+++ b/client/components/editor/editor-markdown.vue
@@ -182,10 +182,11 @@
 <script>
 import _ from 'lodash'
 import { get, sync } from 'vuex-pathify'
 import markdownHelp from './markdown/help.vue'
 import gql from 'graphql-tag'
+import DOMPurify from 'dompurify'
 
 /* global siteConfig, siteLangs */
 
 // ========================================
 // IMPORTS
@@ -393,11 +394,11 @@ export default {
       this.helpShown = false
     },
     onCmInput: _.debounce(function (newContent) {
       linesMap = []
       this.$store.set('editor/content', newContent)
-      this.previewHTML = md.render(newContent)
+      this.previewHTML = DOMPurify.sanitize(md.render(newContent))
       this.$nextTick(() => {
         this.renderMermaidDiagrams()
         Prism.highlightAllUnder(this.$refs.editorPreview)
         Array.from(this.$refs.editorPreview.querySelectorAll('pre.line-numbers')).forEach(pre => pre.classList.add('prismjs'))
         this.scrollSync(this.cm)
diff --git a/package.json b/package.json
index 795f6e29..a79fc2f4 100644
--- a/package.json
+++ b/package.json
@@ -63,10 +63,11 @@
     "cors": "2.8.5",
     "custom-error-instance": "2.1.1",
     "dependency-graph": "0.9.0",
     "diff": "4.0.2",
     "diff2html": "3.1.6",
+    "dompurify": "2.0.10",
     "dotize": "0.3.0",
     "elasticsearch6": "npm:@elastic/elasticsearch@6",
     "elasticsearch7": "npm:@elastic/elasticsearch@7",
     "emoji-regex": "9.0.0",
     "eventemitter2": "6.3.1",
diff --git a/yarn.lock b/yarn.lock
index df759ad5..9c522b55 100644
Binary files a/yarn.lock and b/yarn.lock differ

Vulnerable code:       this.previewHTML = md.render(newContent)
Fixed code: import DOMPurify from 'dompurify'
      this.previewHTML = DOMPurify.sanitize(md.render(newContent))
    "dompurify": "2.0.10",
CVE-2021-21383: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Wiki.js an open-source wiki app built on Node.js. Wiki.js before version 2.5.191 is vulnerable to stored cross-site scripting through mustache expressions in code blocks. This vulnerability exists due to mustache expressions being parsed by Vue during content injection even though it is contained within a `<pre>` element. By creating a crafted wiki page, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the page is viewed by other users. For an example see referenced GitHub Security Advisory. Commit 5ffa189383dd716f12b56b8cae2ba0d075996cf1 fixes this vulnerability by adding the v-pre directive to all `<pre>` tags during the render.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-03-18T17:15Z
Repository: https://github.com/Requarks/wiki
Language: JavaScript
Files changed: server/modules/rendering/html-core/renderer.js
Commit date: 2021-03-11 19:23:24 -0500
Commit message: fix: add v-pre to pre tags at render time

Diff: diff --git a/server/modules/rendering/html-core/renderer.js b/server/modules/rendering/html-core/renderer.js
index 33cf949ed..1c618781a 100644
--- a/server/modules/rendering/html-core/renderer.js
+++ b/server/modules/rendering/html-core/renderer.js
@@ -259,10 +259,14 @@ module.exports = {
         }
       })
     }
     iterateMustacheNode($.root())
 
+    $('pre').each((idx, elm) => {
+      $(elm).attr('v-pre', true)
+    })
+
     // --------------------------------
     // STEP: POST
     // --------------------------------
 
     let output = decodeEscape($.html('body').replace('<body>', '').replace('</body>', ''))

Fixed code:     $('pre').each((idx, elm) => {
      $(elm).attr('v-pre', true)
    })
CVE-2021-43800: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
value: Wiki.js is a wiki app built on Node.js. Prior to version 2.5.254, directory traversal outside of Wiki.js context is possible when a storage module with local asset cache fetching is enabled on a Windows host. A malicious user can potentially read any file on the file system by crafting a special URL that allows for directory traversal. This is only possible on a Wiki.js server running on Windows, when a storage module implementing local asset cache (e.g Local File System or Git) is enabled and that no web application firewall solution (e.g. cloudflare) strips potentially malicious URLs. Commit number 414033de9dff66a327e3f3243234852f468a9d85 fixes this vulnerability by sanitizing the path before it is passed on to the storage module. The sanitization step removes any windows directory traversal sequences from the path. As a workaround, disable any storage module with local asset caching capabilities (Local File System, Git).
CWE description: The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.
CVSS v3 base score: 7.5
Published: 2021-12-06T19:15Z
Repository: https://github.com/Requarks/wiki
Language: JavaScript
Files changed: server/helpers/page.js
Commit date: 2021-12-03 22:30:22 -0500
Commit message: fix: asset path traversal on windows


Diff: diff --git a/server/helpers/page.js b/server/helpers/page.js
index e2e036482..12d4b0228 100644
--- a/server/helpers/page.js
+++ b/server/helpers/page.js
@@ -33,10 +33,12 @@ module.exports = {
     rawPath = _.trim(qs.unescape(rawPath))
     if (_.startsWith(rawPath, '/')) { rawPath = rawPath.substring(1) }
     rawPath = rawPath.replace(unsafeCharsRegex, '')
     if (rawPath === '') { rawPath = 'home' }
 
+    rawPath = rawPath.replaceAll('\\', '').replaceAll('//', '').replaceAll(/\.\.+/ig, '')
+
     // Extract Info
     let pathParts = _.filter(_.split(rawPath, '/'), p => {
       p = _.trim(p)
       return !_.isEmpty(p) && p !== '..' && p !== '.'
     })

Fixed code:     rawPath = rawPath.replaceAll('\\', '').replaceAll('//', '').replaceAll(/\.\.+/ig, '')
CVE-2021-43855: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
value: Wiki.js is a wiki app built on node.js. Wiki.js 2.5.263 and earlier is vulnerable to stored cross-site scripting through a SVG file upload made via a custom request with a fake MIME type. By creating a crafted SVG file, a malicious Wiki.js user may stage a stored cross-site scripting attack. This allows the attacker to execute malicious JavaScript when the SVG is viewed directly by other users. Scripts do not execute when loaded inside a page via normal `<img>` tags. The malicious SVG can only be uploaded by crafting a custom request to the server with a fake MIME type. A patch in version 2.5.264 fixes this vulnerability by adding an additional file extension verification check to the optional (enabled by default) SVG sanitization step to all file uploads that match the SVG mime type. As a workaround, disable file upload for all non-trusted users.
CWE description: The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVSS v3 base score: 5.4
Published: 2021-12-27T18:15Z
Repository: https://github.com/Requarks/wiki
Language: JavaScript
Files changed: server/models/assets.js
Commit date: 2021-12-24 19:36:30 -0500
Commit message: fix: validate svg file extension in addition to client mime type


Diff: diff --git a/server/models/assets.js b/server/models/assets.js
index 8548319fa..9d0a79b1c 100644
--- a/server/models/assets.js
+++ b/server/models/assets.js
@@ -98,11 +98,17 @@ module.exports = class Asset extends Model {
       fileSize: opts.size,
       folderId: opts.folderId
     }
 
     // Sanitize SVG contents
-    if (WIKI.config.uploads.scanSVG && opts.mimetype === 'image/svg+xml') {
+    if (
+      WIKI.config.uploads.scanSVG &&
+      (
+        opts.mimetype.toLowerCase().startsWith('image/svg') ||
+        opts.ext.toLowerCase() === 'svg'
+      )
+    ) {
       const svgSanitizeJob = await WIKI.scheduler.registerJob({
         name: 'sanitize-svg',
         immediate: true,
         worker: true
       }, opts.path)

Vulnerable code:     if (WIKI.config.uploads.scanSVG && opts.mimetype === 'image/svg+xml') {
Fixed code:     if (
      WIKI.config.uploads.scanSVG &&
      (
        opts.mimetype.toLowerCase().startsWith('image/svg') ||
        opts.ext.toLowerCase() === 'svg'
      )
    ) {
CVE-2022-23654: Other (NVD-CWE-Other)
value: Wiki.js is a wiki app built on Node.js. In affected versions an authenticated user with write access on a restricted set of paths can update a page outside the allowed paths by specifying a different target page ID while keeping the path intact. The access control incorrectly check the path access against the user-provided values instead of the actual path associated to the page ID. Commit https://github.com/Requarks/wiki/commit/411802ec2f654bb5ed1126c307575b81e2361c6b fixes this vulnerability by checking access control on the path associated with the page ID instead of the user-provided value. When the path is different than the current value, a second access control check is then performed on the user-provided path before the move operation.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 6.5
Published: 2022-02-22T20:15Z
Repository: https://github.com/Requarks/wiki
Language: JavaScript
Files changed: server/models/pages.js
Commit date: 2022-02-20 18:46:03 -0500
Commit message: fix: check update page access using original page path

Diff: diff --git a/server/models/pages.js b/server/models/pages.js
index cd7863746..5d941bc5f 100644
--- a/server/models/pages.js
+++ b/server/models/pages.js
@@ -369,12 +369,12 @@ module.exports = class Page extends Model {
       throw new Error('Invalid Page Id')
     }
 
     // -> Check for page access
     if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
-      locale: opts.locale,
-      path: opts.path
+      locale: ogPage.localeCode,
+      path: ogPage.path
     })) {
       throw new WIKI.Error.PageUpdateForbidden()
     }
 
     // -> Check for empty content
@@ -454,10 +454,18 @@ module.exports = class Page extends Model {
       })
     }
 
     // -> Perform move?
     if ((opts.locale && opts.locale !== page.localeCode) || (opts.path && opts.path !== page.path)) {
+      // -> Check target path access
+      if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
+        locale: opts.locale,
+        path: opts.path
+      })) {
+        throw new WIKI.Error.PageMoveForbidden()
+      }
+
       await WIKI.models.pages.movePage({
         id: page.id,
         destinationLocale: opts.locale,
         destinationPath: opts.path,
         user: opts.user

Vulnerable code:       locale: opts.locale,
      path: opts.path
Fixed code:       locale: ogPage.localeCode,
      path: ogPage.path
      // -> Check target path access
      if (!WIKI.auth.checkAccess(opts.user, ['write:pages'], {
        locale: opts.locale,
        path: opts.path
      })) {
        throw new WIKI.Error.PageMoveForbidden()
      }
CVE-2015-8872: Numeric Errors (CWE-189)
value: The set_fat function in fat.c in dosfstools before 4.0 might allow attackers to corrupt a FAT12 filesystem or cause a denial of service (invalid memory read and crash) by writing an odd number of clusters to the third to last entry on a FAT12 filesystem, which triggers an "off-by-two error."
CWE description: Weaknesses in this category are related to improper calculation or conversion of numbers.
CVSS v3 base score: 6.2
Published: 2016-06-03T14:59Z
Repository: https://github.com/dosfstools/dosfstools
Language: C
Files changed: src/fat.c
Commit date: 2015-09-11 20:09:24 +0200
Commit message: set_fat(): Fix off-by-2 error leading to corruption in FAT12

In FAT12 two 12 bit entries are combined to a 24 bit value (three
bytes). Therefore, when an even numbered FAT entry is set in FAT12, it
must be be combined with the following entry. To prevent accessing
beyond the end of the FAT array, it must be checked that the cluster is
not the last one.

Previously, the check tested that the requested cluster was equal to
fs->clusters - 1. However, fs->clusters is the number of data clusters
not including the two reserved FAT entries at the start so the test
triggered two clusters early.

If the third to last entry was written on a FAT12 filesystem with an
odd number of clusters, the second to last entry would be corrupted.
This corruption may also lead to invalid memory accesses when the
corrupted entry becomes out of bounds and is used later.

Change the test to fs->clusters + 1 to fix.

Reported-by: Hanno Böck
Signed-off-by: Andreas Bombe <aeb@debian.org>

Diff: diff --git a/src/fat.c b/src/fat.c
index 0c19184..845b748 100644
--- a/src/fat.c
+++ b/src/fat.c
@@ -203,11 +203,11 @@ void set_fat(DOS_FS * fs, uint32_t cluster, int32_t new)
 	    get_fat(&prevEntry, fs->fat, cluster - 1, fs);
 	    data[0] = ((new & 0xf) << 4) | (prevEntry.value >> 8);
 	    data[1] = new >> 4;
 	} else {
 	    FAT_ENTRY subseqEntry;
-	    if (cluster != fs->clusters - 1)
+	    if (cluster != fs->clusters + 1)
 		get_fat(&subseqEntry, fs->fat, cluster + 1, fs);
 	    else
 		subseqEntry.value = 0;
 	    data[0] = new & 0xff;
 	    data[1] = (new >> 8) | ((0xff & subseqEntry.value) << 4);

Vulnerable code: 	    if (cluster != fs->clusters - 1)
Fixed code: 	    if (cluster != fs->clusters + 1)
CVE-2012-1013: Other (NVD-CWE-Other)
value: The check_1_6_dummy function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.8.x, 1.9.x, and 1.10.x before 1.10.2 allows remote authenticated administrators to cause a denial of service (NULL pointer dereference and daemon crash) via a KRB5_KDB_DISALLOW_ALL_TIX create request that lacks a password.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2012-06-07T19:55Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/lib/kadm5/srv/svr_principal.c
Commit date: 2012-05-29 14:10:27 -0400
Commit message: Null pointer deref in kadmind [CVE-2012-1013]

The fix for #6626 could cause kadmind to dereference a null pointer if
a create-principal request contains no password but does contain the
KRB5_KDB_DISALLOW_ALL_TIX flag (e.g. "addprinc -randkey -allow_tix
name").  Only clients authorized to create principals can trigger the
bug.  Fix the bug by testing for a null password in check_1_6_dummy.

CVSSv2 vector: AV:N/AC:M/Au:S/C:N/I:N/A:P/E:H/RL:O/RC:C

[ghudson@mit.edu: Minor style change and commit message]

ticket: 7152
target_version: 1.10.2
tags: pullup

Diff: diff --git a/src/lib/kadm5/srv/svr_principal.c b/src/lib/kadm5/srv/svr_principal.c
index a0b110def..f5ea005b2 100644
--- a/src/lib/kadm5/srv/svr_principal.c
+++ b/src/lib/kadm5/srv/svr_principal.c
@@ -184,11 +184,11 @@ check_1_6_dummy(kadm5_principal_ent_t entry, long mask,
 {
     int i;
     char *password = *passptr;
 
     /* Old-style randkey operations disallowed tickets to start. */
-    if (!(mask & KADM5_ATTRIBUTES) ||
+    if (password == NULL || !(mask & KADM5_ATTRIBUTES) ||
         !(entry->attributes & KRB5_KDB_DISALLOW_ALL_TIX))
         return;
 
     /* The 1.6 dummy password was the octets 1..255. */
     for (i = 0; (unsigned char) password[i] == i + 1; i++);

Vulnerable code:     if (!(mask & KADM5_ATTRIBUTES) ||
Fixed code:     if (password == NULL || !(mask & KADM5_ATTRIBUTES) ||
CVE-2014-4344: NULL Pointer Dereference (CWE-476)
value: The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
Published: 2014-08-14T05:01Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/lib/gssapi/spnego/spnego_mech.c
Commit date: 2014-07-21 12:53:18 -0400
Commit message: Fix null deref in SPNEGO acceptor [CVE-2014-4344]

When processing a continuation token, acc_ctx_cont was dereferencing
the initial byte of the token without checking the length.  This could
result in a null dereference.

CVE-2014-4344:

In MIT krb5 1.5 and newer, an unauthenticated or partially
authenticated remote attacker can cause a NULL dereference and
application crash during a SPNEGO negotiation by sending an empty
token as the second or later context token from initiator to acceptor.
The attacker must provide at least one valid context token in the
security context negotiation before sending the empty token.  This can
be done by an unauthenticated attacker by forcing SPNEGO to
renegotiate the underlying mechanism, or by using IAKERB to wrap an
unauthenticated AS-REQ as the first token.

    CVSSv2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:C/E:POC/RL:OF/RC:C

[kaduk@mit.edu: CVE summary, CVSSv2 vector]

ticket: 7970 (new)
subject: NULL dereference in SPNEGO acceptor for continuation tokens [CVE-2014-4344]
target_version: 1.12.2
tags: pullup

Diff: diff --git a/src/lib/gssapi/spnego/spnego_mech.c b/src/lib/gssapi/spnego/spnego_mech.c
index 8f829d8c59..2aa6810a9c 100644
--- a/src/lib/gssapi/spnego/spnego_mech.c
+++ b/src/lib/gssapi/spnego/spnego_mech.c
@@ -1466,11 +1466,11 @@ acc_ctx_cont(OM_uint32 *minstat,
 	*return_token = ERROR_TOKEN_SEND;
 	*responseToken = *mechListMIC = GSS_C_NO_BUFFER;
 
 	ptr = bufstart = buf->value;
 #define REMAIN (buf->length - (ptr - bufstart))
-	if (REMAIN > INT_MAX)
+	if (REMAIN == 0 || REMAIN > INT_MAX)
 		return GSS_S_DEFECTIVE_TOKEN;
 
 	/*
 	 * Attempt to work with old Sun SPNEGO.
 	 */

Vulnerable code: 	if (REMAIN > INT_MAX)
Fixed code: 	if (REMAIN == 0 || REMAIN > INT_MAX)
CVE-2014-9421: Other (NVD-CWE-Other)
value: The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly handle partial XDR deserialization, which allows remote authenticated users to cause a denial of service (use-after-free and double free, and daemon crash) or possibly execute arbitrary code via malformed XDR data, as demonstrated by data sent to kadmind.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
Published: 2015-02-19T11:59Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/lib/kadm5/kadm_rpc_xdr.c, src/lib/rpc/auth_gssapi_misc.c
Commit date: 2015-02-04 14:26:15 -0500
Commit message: Fix kadm5/gssrpc XDR double free [CVE-2014-9421]

[MITKRB5-SA-2015-001] In auth_gssapi_unwrap_data(), do not free
partial deserialization results upon failure to deserialize.  This
responsibility belongs to the callers, svctcp_getargs() and
svcudp_getargs(); doing it in the unwrap function results in freeing
the results twice.

In xdr_krb5_tl_data() and xdr_krb5_principal(), null out the pointers
we are freeing, as other XDR functions such as xdr_bytes() and
xdr_string().

ticket: 8056 (new)
target_version: 1.13.1
tags: pullup

Diff: diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
index 42ac783ad10..975f94c6c6a 100644
--- a/src/lib/kadm5/kadm_rpc_xdr.c
+++ b/src/lib/kadm5/kadm_rpc_xdr.c
@@ -318,10 +318,11 @@ bool_t xdr_krb5_tl_data(XDR *xdrs, krb5_tl_data **tl_data_head)
 	       tl2 = tl->tl_data_next;
 	       free(tl->tl_data_contents);
 	       free(tl);
 	       tl = tl2;
 	  }
+	  *tl_data_head = NULL;
 	  break;
 
      case XDR_ENCODE:
 	  tl = *tl_data_head;
 	  while (1) {
@@ -1094,10 +1095,11 @@ xdr_krb5_principal(XDR *xdrs, krb5_principal *objp)
 	     *objp = NULL;
 	break;
     case XDR_FREE:
 	if(*objp != NULL)
 	    krb5_free_principal(context, *objp);
+	*objp = NULL;
 	break;
     }
     return TRUE;
 }
 
diff --git a/src/lib/rpc/auth_gssapi_misc.c b/src/lib/rpc/auth_gssapi_misc.c
index 53bdb983c45..a05ea19eb7c 100644
--- a/src/lib/rpc/auth_gssapi_misc.c
+++ b/src/lib/rpc/auth_gssapi_misc.c
@@ -320,11 +320,10 @@ bool_t auth_gssapi_unwrap_data(
 
      /* deserialize the arguments into xdr_ptr */
      if (! (*xdr_func)(&temp_xdrs, xdr_ptr)) {
 	  PRINTF(("gssapi_unwrap_data: deserializing arguments failed\n"));
 	  gss_release_buffer(minor, &out_buf);
-	  xdr_free(xdr_func, xdr_ptr);
 	  XDR_DESTROY(&temp_xdrs);
 	  return FALSE;
      }
 
      PRINTF(("gssapi_unwrap_data: succeeding\n\n"));

Vulnerable code: 	  xdr_free(xdr_func, xdr_ptr);
Fixed code: 	  *tl_data_head = NULL;
	*objp = NULL;
CVE-2014-9422: Improper Access Control (CWE-284)
value: The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows remote authenticated users to bypass a kadmin/* authorization check and obtain administrative access by leveraging access to a two-component principal with an initial "kadmind" substring, as demonstrated by a "ka/x" principal.
CWE description: The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.
Published: 2015-02-19T11:59Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/kadmin/server/kadm_rpc_svc.c
Commit date: 2015-02-04 14:26:15 -0500
Commit message: Fix kadmind server validation [CVE-2014-9422]

[MITKRB5-SA-2015-001] In kadmind's check_rpcsec_auth(), use
data_eq_string() instead of strncmp() to check components of the
server principal, so that we don't erroneously match left substrings
of "kadmin", "history", or the realm.

ticket: 8057 (new)
target_version: 1.13.1
tags: pullup

Diff: diff --git a/src/kadmin/server/kadm_rpc_svc.c b/src/kadmin/server/kadm_rpc_svc.c
index 3837931b6f3..f4d2a7cba7b 100644
--- a/src/kadmin/server/kadm_rpc_svc.c
+++ b/src/kadmin/server/kadm_rpc_svc.c
@@ -2,11 +2,11 @@
 /*
  * Copyright 1993 OpenVision Technologies, Inc., All Rights Reserved.
  *
  */
 
-#include <k5-platform.h>
+#include <k5-int.h>
 #include <gssrpc/rpc.h>
 #include <gssapi/gssapi_krb5.h> /* for gss_nt_krb5_name */
 #include <syslog.h>
 #include <kadm5/kadm_rpc.h>
 #include <krb5.h>
@@ -294,18 +294,12 @@ check_rpcsec_auth(struct svc_req *rqstp)
 	  goto fail_princ;
 
      c1 = krb5_princ_component(kctx, princ, 0);
      c2 = krb5_princ_component(kctx, princ, 1);
      realm = krb5_princ_realm(kctx, princ);
-     if (strncmp(handle->params.realm, realm->data, realm->length) == 0
-	 && strncmp("kadmin", c1->data, c1->length) == 0) {
-
-	  if (strncmp("history", c2->data, c2->length) == 0)
-	       goto fail_princ;
-	  else
-	       success = 1;
-     }
+     success = data_eq_string(*realm, handle->params.realm) &&
+	     data_eq_string(*c1, "kadmin") && !data_eq_string(*c2, "history");
 
 fail_princ:
      if (!success) {
 	 krb5_klog_syslog(LOG_ERR, _("bad service principal %.*s%s"),
 			  (int) slen, (char *) gss_str.value, sdots);

Vulnerable code: #include <k5-platform.h>
     if (strncmp(handle->params.realm, realm->data, realm->length) == 0
	 && strncmp("kadmin", c1->data, c1->length) == 0) {

	  if (strncmp("history", c2->data, c2->length) == 0)
	       goto fail_princ;
	  else
	       success = 1;
     }
Fixed code: #include <k5-int.h>
     success = data_eq_string(*realm, handle->params.realm) &&
	     data_eq_string(*c1, "kadmin") && !data_eq_string(*c2, "history");
CVE-2015-2697: Out-of-bounds Read (CWE-125)
value: The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds read and KDC crash) via an initial '\0' character in a long realm field within a TGS request.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
Published: 2015-11-09T03:59Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/lib/krb5/krb/bld_princ.c
Commit date: 2015-10-26 13:43:36 -0400
Commit message: Fix build_principal memory bug [CVE-2015-2697]

In build_principal_va(), use k5memdup0() instead of strdup() to make a
copy of the realm, to ensure that we allocate the correct number of
bytes and do not read past the end of the input string.  This bug
affects krb5_build_principal(), krb5_build_principal_va(), and
krb5_build_principal_alloc_va().  krb5_build_principal_ext() is not
affected.

CVE-2015-2697:

In MIT krb5 1.7 and later, an authenticated attacker may be able to
cause a KDC to crash using a TGS request with a large realm field
beginning with a null byte.  If the KDC attempts to find a referral to
answer the request, it constructs a principal name for lookup using
krb5_build_principal() with the requested realm.  Due to a bug in this
function, the null byte causes only one byte be allocated for the
realm field of the constructed principal, far less than its length.
Subsequent operations on the lookup principal may cause a read beyond
the end of the mapped memory region, causing the KDC process to crash.

CVSSv2: AV:N/AC:L/Au:S/C:N/I:N/A:C/E:POC/RL:OF/RC:C

ticket: 8252 (new)
target_version: 1.14
tags: pullup

Diff: diff --git a/src/lib/krb5/krb/bld_princ.c b/src/lib/krb5/krb/bld_princ.c
index ab6fed897f1..8604268ceb8 100644
--- a/src/lib/krb5/krb/bld_princ.c
+++ b/src/lib/krb5/krb/bld_princ.c
@@ -38,14 +38,12 @@ build_principal_va(krb5_context context, krb5_principal princ,
     char *component = NULL;
 
     data = malloc(size * sizeof(krb5_data));
     if (!data) { retval = ENOMEM; }
 
-    if (!retval) {
-        r = strdup(realm);
-        if (!r) { retval = ENOMEM; }
-    }
+    if (!retval)
+        r = k5memdup0(realm, rlen, &retval);
 
     while (!retval && (component = va_arg(ap, char *))) {
         if (count == size) {
             krb5_data *new_data = NULL;
 

Vulnerable code:     if (!retval) {
        r = strdup(realm);
        if (!r) { retval = ENOMEM; }
    }
Fixed code:     if (!retval)
        r = k5memdup0(realm, rlen, &retval);
CVE-2015-8629: Out-of-bounds Read (CWE-125)
value: The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service (out-of-bounds read) via a crafted string.
CWE description: The product reads data past the end, or before the beginning, of the intended buffer.
CVSS v3 base score: 5.3
Published: 2016-02-13T02:59Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/lib/kadm5/kadm_rpc_xdr.c
Commit date: 2016-01-27 15:43:27 -0500
Commit message: Verify decoded kadmin C strings [CVE-2015-8629]

In xdr_nullstring(), check that the decoded string is terminated with
a zero byte and does not contain any internal zero bytes.

CVE-2015-8629:

In all versions of MIT krb5, an authenticated attacker can cause
kadmind to read beyond the end of allocated memory by sending a string
without a terminating zero byte.  Information leakage may be possible
for an attacker with permission to modify the database.

    CVSSv2 Vector: AV:N/AC:H/Au:S/C:P/I:N/A:N/E:POC/RL:OF/RC:C

ticket: 8341 (new)
target_version: 1.14-next
target_version: 1.13-next
tags: pullup

Diff: diff --git a/src/lib/kadm5/kadm_rpc_xdr.c b/src/lib/kadm5/kadm_rpc_xdr.c
index 2bef8586312..ba670841056 100644
--- a/src/lib/kadm5/kadm_rpc_xdr.c
+++ b/src/lib/kadm5/kadm_rpc_xdr.c
@@ -62,11 +62,18 @@ bool_t xdr_nullstring(XDR *xdrs, char **objp)
 	       if (*objp == NULL) {
 		    errno = ENOMEM;
 		    return FALSE;
 	       }
 	  }
-	  return (xdr_opaque(xdrs, *objp, size));
+	  if (!xdr_opaque(xdrs, *objp, size))
+		  return FALSE;
+	  /* Check that the unmarshalled bytes are a C string. */
+	  if ((*objp)[size - 1] != '\0')
+		  return FALSE;
+	  if (memchr(*objp, '\0', size - 1) != NULL)
+		  return FALSE;
+	  return TRUE;
 
      case XDR_ENCODE:
 	  if (size != 0)
 	       return (xdr_opaque(xdrs, *objp, size));
 	  return TRUE;

Vulnerable code: 	  return (xdr_opaque(xdrs, *objp, size));
Fixed code: 	  if (!xdr_opaque(xdrs, *objp, size))
		  return FALSE;
	  /* Check that the unmarshalled bytes are a C string. */
	  if ((*objp)[size - 1] != '\0')
		  return FALSE;
	  if (memchr(*objp, '\0', size - 1) != NULL)
		  return FALSE;
	  return TRUE;
CVE-2016-3119: Other (NVD-CWE-Other)
value: The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through 1.14.1 mishandles the DB argument, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request to modify a principal.
CWE description: NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.
CVSS v3 base score: 5.3
Published: 2016-03-26T01:59Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
Commit date: 2016-03-18 16:24:28 -0400
Commit message: Fix LDAP null deref on empty arg [CVE-2016-3119]

In the LDAP KDB module's process_db_args(), strtok_r() may return NULL
if there is an empty string in the db_args array.  Check for this case
and avoid dereferencing a null pointer.

CVE-2016-3119:

In MIT krb5 1.6 and later, an authenticated attacker with permission
to modify a principal entry can cause kadmind to dereference a null
pointer by supplying an empty DB argument to the modify_principal
command, if kadmind is configured to use the LDAP KDB module.

    CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:ND

ticket: 8383 (new)
target_version: 1.14-next
target_version: 1.13-next
tags: pullup

Diff: diff --git a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
index 6e591e19742..79c4cf05cc2 100644
--- a/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
+++ b/src/plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c
@@ -294,10 +294,11 @@ process_db_args(krb5_context context, char **db_args, xargs_t *xargs,
     unsigned int          arg_val_len=0;
 
     if (db_args) {
         for (i=0; db_args[i]; ++i) {
             arg = strtok_r(db_args[i], "=", &arg_val);
+            arg = (arg != NULL) ? arg : "";
             if (strcmp(arg, TKTPOLICY_ARG) == 0) {
                 dptr = &xargs->tktpolicydn;
             } else {
                 if (strcmp(arg, USERDN_ARG) == 0) {
                     if (optype == MODIFY_PRINCIPAL ||

Fixed code:             arg = (arg != NULL) ? arg : "";
CVE-2016-3120: NULL Pointer Dereference (CWE-476)
value: The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when restrict_anonymous_to_tgt is enabled, uses an incorrect client data structure, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and daemon crash) via an S4U2Self request.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2016-08-01T02:59Z
Repository: https://github.com/krb5/krb5
Language: Python
Files changed: src/kdc/kdc_util.c, src/tests/t_pkinit.py
Commit date: 2016-07-19 12:35:42 -0400
Commit message: Fix S4U2Self KDC crash when anon is restricted

In validate_as_request(), when enforcing restrict_anonymous_to_tgt,
use client.princ instead of request->client; the latter is NULL when
validating S4U2Self requests.

CVE-2016-3120:

In MIT krb5 1.9 and later, an authenticated attacker can cause krb5kdc
to dereference a null pointer if the restrict_anonymous_to_tgt option
is set to true, by making an S4U2Self request.

  CVSSv2 Vector: AV:N/AC:H/Au:S/C:N/I:N/A:C/E:H/RL:OF/RC:C

ticket: 8458 (new)
target_version: 1.14-next
target_version: 1.13-next

Diff: diff --git a/src/kdc/kdc_util.c b/src/kdc/kdc_util.c
index 776e130e556..29f9dbbf07e 100644
--- a/src/kdc/kdc_util.c
+++ b/src/kdc/kdc_util.c
@@ -737,11 +737,11 @@ validate_as_request(kdc_realm_t *kdc_active_realm,
     if (isflagset(server.attributes, KRB5_KDB_DISALLOW_SVR)) {
         *status = "SERVICE NOT ALLOWED";
         return(KDC_ERR_MUST_USE_USER2USER);
     }
 
-    if (check_anon(kdc_active_realm, request->client, request->server) != 0) {
+    if (check_anon(kdc_active_realm, client.princ, request->server) != 0) {
         *status = "ANONYMOUS NOT ALLOWED";
         return(KDC_ERR_POLICY);
     }
 
     /* Perform KDB module policy checks. */
diff --git a/src/tests/t_pkinit.py b/src/tests/t_pkinit.py
index b66c458dff4..f0214b6529e 100755
--- a/src/tests/t_pkinit.py
+++ b/src/tests/t_pkinit.py
@@ -91,10 +91,15 @@ realm.kinit('@%s' % realm.realm, flags=['-n'])
 realm.kinit('@%s' % realm.realm, flags=['-n', '-T', realm.ccache])
 out = realm.run([kvno, realm.host_princ], expected_code=1)
 if 'KDC policy rejects request' not in out:
     fail('Wrong error for restricted anonymous PKINIT')
 
+# Regression test for #8458: S4U2Self requests crash the KDC if
+# anonymous is restricted.
+realm.kinit(realm.host_princ, flags=['-k'])
+realm.run([kvno, '-U', 'user', realm.host_princ])
+
 # Go back to a normal KDC and disable anonymous PKINIT.
 realm.stop_kdc()
 realm.start_kdc()
 realm.run([kadminl, 'delprinc', 'WELLKNOWN/ANONYMOUS'])
 

Vulnerable code:     if (check_anon(kdc_active_realm, request->client, request->server) != 0) {
Fixed code:     if (check_anon(kdc_active_realm, client.princ, request->server) != 0) {
# Regression test for #8458: S4U2Self requests crash the KDC if
# anonymous is restricted.
realm.kinit(realm.host_princ, flags=['-k'])
realm.run([kvno, '-U', 'user', realm.host_princ])
CVE-2021-37750: NULL Pointer Dereference (CWE-476)
value: The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.
CWE description: The product dereferences a pointer that it expects to be valid but is NULL.
CVSS v3 base score: 6.5
Published: 2021-08-23T05:15Z
Repository: https://github.com/krb5/krb5
Language: C
Files changed: src/kdc/do_tgs_req.c
Commit date: 2021-08-19 10:56:07 -0400
Commit message: Fix KDC null deref on TGS inner body null server

After the KDC decodes a FAST inner body, it does not check for a null
server.  Prior to commit 39548a5b17bbda9eeb63625a201cfd19b9de1c5b this
would typically result in an error from krb5_unparse_name(), but with
the addition of get_local_tgt() it results in a null dereference.  Add
a null check.

Reported by Joseph Sutton of Catalyst.

CVE-2021-37750:

In MIT krb5 releases 1.14 and later, an authenticated attacker can
cause a null dereference in the KDC by sending a FAST TGS request with
no server field.

ticket: 9008 (new)
tags: pullup
target_version: 1.19-next
target_version: 1.18-next

Diff: diff --git a/src/kdc/do_tgs_req.c b/src/kdc/do_tgs_req.c
index 582e497cc99b..32dc65fa8ef4 100644
--- a/src/kdc/do_tgs_req.c
+++ b/src/kdc/do_tgs_req.c
@@ -202,10 +202,15 @@ process_tgs_req(krb5_kdc_req *request, krb5_data *pkt,
     sprinc = request->server;
     if (errcode !=0) {
         status = "FIND_FAST";
         goto cleanup;
     }
+    if (sprinc == NULL) {
+        status = "NULL_SERVER";
+        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
+        goto cleanup;
+    }
 
     errcode = get_local_tgt(kdc_context, &sprinc->realm, header_server,
                             &local_tgt, &local_tgt_storage, &local_tgt_key);
     if (errcode) {
         status = "GET_LOCAL_TGT";

Fixed code:     if (sprinc == NULL) {
        status = "NULL_SERVER";
        errcode = KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN;
        goto cleanup;
    }