kumquat-buildroot/package/heimdal/heimdal.hash

# From https://github.com/heimdal/heimdal/releases
sha1  a33fdc957f84ab13f39f164b04fe1deeaab3179e  heimdal-7.7.1.tar.gz
sha256  117cb1ede7848db24cf27311c46f7f735a99f9c836c22e80aec92b91efe56644  heimdal-7.7.1.tar.gz
# Locally computed
sha256  0c4b07bf5b98f7a1d01f8e60722d6c6747ef052c2aa6d2043daf690d4e1b0a7f  LICENSE
package/heimdal: bump version to 7.7.0 Added upstream hashes and license hash. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2019-07-22 18:12:12 +02:00			`# From https://github.com/heimdal/heimdal/releases`
package/heimdal: security bump to version 7.7.1 This release fixes the following Security Vulnerabilities: - CVE-2022-42898 PAC parse integer overflows - CVE-2022-3437 Overflows and non-constant time leaks in DES{,3} and arcfour - CVE-2022-41916 Fix Unicode normalization read of 1 bytes past end of array - CVE-2021-44758 NULL dereference DoS in SPNEGO acceptors - CVE-2021-3671 A null pointer de-reference when handling missing sname in TGS-REQ - CVE-2022-44640 Heimdal KDC: invalid free in ASN.1 codec Note that CVE-2022-44640 is a severe vulnerability, possibly a 10.0 on the Common Vulnerability Scoring System (CVSS) v3, as we believe it should be possible to get an RCE on a KDC, which means that credentials can be compromised that can be used to impersonate anyone in a realm or forest of realms. Heimdal's ASN.1 compiler generates code that allows specially crafted DER encodings of CHOICEs to invoke the wrong free function on the decoded structure upon decode error. This is known to impact the Heimdal KDC, leading to an invalid free() of an address partly or wholly under the control of the attacker, in turn leading to a potential remote code execution (RCE) vulnerability. This error affects the DER codec for all extensible CHOICE types used in Heimdal, though not all cases will be exploitable. We have not completed a thorough analysis of all the Heimdal components affected, thus the Kerberos client, the X.509 library, and other parts, may be affected as well. This bug has been in Heimdal's ASN.1 compiler since 2005, but it may only affect Heimdal 1.6 and up. It was first reported by Douglas Bagnall, though it had been found independently by the Heimdal maintainers via fuzzing a few weeks earlier. While no zero-day exploit is known, such an exploit will likely be available soon after public disclosure. - CVE-2019-14870: Validate client attributes in protocol-transition - CVE-2019-14870: Apply forwardable policy in protocol-transition - CVE-2019-14870: Always lookup impersonate client in DB Signed-off-by: Fabrice Fontaine <fontaine.fabrice@gmail.com> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2022-11-23 23:24:01 +01:00			`sha1 a33fdc957f84ab13f39f164b04fe1deeaab3179e heimdal-7.7.1.tar.gz`
			`sha256 117cb1ede7848db24cf27311c46f7f735a99f9c836c22e80aec92b91efe56644 heimdal-7.7.1.tar.gz`
package/heimdal: bump version to 7.7.0 Added upstream hashes and license hash. Signed-off-by: Bernd Kuhls <bernd.kuhls@t-online.de> Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2019-07-22 18:12:12 +02:00			`# Locally computed`
boot, package, support, toolchain: switch to 2 spaces for the hash file It's time to finally switch over globally to the new spacing format that we have agreed on for the hash file, with 2 spaces as a separator between fields. This commit was mechanically generated using: find . -type f -name '.hash' \| xargs sed -i 's%^md5[ \t]\([^ \t]\)[ \t]\(.\)$%md5 \1 \2%' find . -type f -name '.hash' \| xargs sed -i 's%^sha1[ \t]\([^ \t]\)[ \t]\(.\)$%sha1 \1 \2%' find . -type f -name '.hash' \| xargs sed -i 's%^sha256[ \t]\([^ \t]\)[ \t]\(.\)$%sha256 \1 \2%' find . -type f -name '.hash' \| xargs sed -i 's%^sha512[ \t]\([^ \t]\)[ \t]\(.\)$%sha512 \1 \2%' This commit can easily be backported on the LTS branch by re-running the same commands, if needed. Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com> 2022-07-28 10:07:32 +02:00			`sha256 0c4b07bf5b98f7a1d01f8e60722d6c6747ef052c2aa6d2043daf690d4e1b0a7f LICENSE`