Your message dated Sat, 09 Nov 2019 20:35:04 +0000
with message-id <e1itxro-000ho0...@fasolo.debian.org>
and subject line Bug#934043: fixed in libapache-mod-auth-kerb 5.4-2.4~deb10u1
has caused the Debian Bug report #934043,
regarding segfaults with use-after-free when using KrbServiceName Any
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact ow...@bugs.debian.org
immediately.)
--
934043: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=934043
Debian Bug Tracking System
Contact ow...@bugs.debian.org with problems
--- Begin Message ---
Package: libapache2-mod-auth-kerb
Version: 5.4-2.3
Severity: grave
Tags: patch upstream
Hi,
After upgrading to buster, mod_auth_kerb keeps on crashing Apache (thus the
grave severity), after printing
double free or corruption (out)
This is indeed a use-after-free; verify_krb5_user gets in a keytab as a
parameter, and chooses to deallocate it even though the parent expects to keep
using it. I don't know why this didn't trigger as often in stretch,
although we've certainly seen mod_auth_kerb segfaults there as well
(especially with outdated keytabs).
The patch is trivial and can be found in upstream's bug tracker; just don't
deallocate the keytab in verify_krb5_user():
https://sourceforge.net/p/modauthkerb/bugs/61/
This is not a leak, since the parent closes it inself, in all paths. I've
verified
that it applies in Debian (just some changed line numbers) and fixes the issue.
Please consider for a buster point release, in addition to unstable.
It makes mod_auth_kerb borderline unusable.
-- System Information:
Debian Release: 10.0
APT prefers testing-debug
APT policy: (500, 'testing-debug'), (500, 'proposed-updates'), (500,
'stable'), (500, 'oldstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Foreign Architectures: i386
Kernel: Linux 5.1.11 (SMP w/40 CPU cores)
Kernel taint flags: TAINT_OOT_MODULE
Locale: LANG=en_DK.UTF-8, LC_CTYPE=en_DK.UTF-8 (charmap=UTF-8),
LANGUAGE=en_NO:en_US:en_GB:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
Versions of packages libapache2-mod-auth-kerb depends on:
ii apache2-bin [apache2-api-20120211] 2.4.38-3
ii krb5-config 2.6
ii libc6 2.28-10
pn libcomerr2 <none>
ii libgssapi-krb5-2 1.17-3
ii libk5crypto3 1.17-3
ii libkrb5-3 1.17-3
libapache2-mod-auth-kerb recommends no packages.
libapache2-mod-auth-kerb suggests no packages.
--- End Message ---
--- Begin Message ---
Source: libapache-mod-auth-kerb
Source-Version: 5.4-2.4~deb10u1
We believe that the bug you reported is fixed in the latest version of
libapache-mod-auth-kerb, which is due to be installed in the Debian FTP archive.
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 934...@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Paul Wise <p...@debian.org> (supplier of updated libapache-mod-auth-kerb
package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmas...@ftp-master.debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Sun, 27 Oct 2019 13:58:04 +0800
Source: libapache-mod-auth-kerb
Architecture: source
Version: 5.4-2.4~deb10u1
Distribution: buster
Urgency: medium
Maintainer: Ghe Rivero <g...@debian.org>
Changed-By: Paul Wise <p...@debian.org>
Closes: 934043
Changes:
libapache-mod-auth-kerb (5.4-2.4~deb10u1) buster; urgency=medium
.
* Rebuild for buster
.
libapache-mod-auth-kerb (5.4-2.4) unstable; urgency=medium
.
* Non-maintainer upload.
* Apply patch from upstream issue tracker to fix crash (Closes: #934043)
Checksums-Sha1:
8cf6b1e0ea6c21f5c3e384118bc8b46d5407014f 1881
libapache-mod-auth-kerb_5.4-2.4~deb10u1.dsc
0d9f4c45c7d9289380dc5db0f3ec9a33fd36f307 51231
libapache-mod-auth-kerb_5.4-2.4~deb10u1.diff.gz
c20360cc9eeff357932c3fa9b89567785c158ebd 7002
libapache-mod-auth-kerb_5.4-2.4~deb10u1_amd64.buildinfo
Checksums-Sha256:
bec82352aaa830f19ab4e60e7fd228b1dabb73bc6d06181c5bf498b7157ce856 1881
libapache-mod-auth-kerb_5.4-2.4~deb10u1.dsc
277ed7a264c281a5266453c8525a830c1aebdb928c48cd267a679fe5d662b994 51231
libapache-mod-auth-kerb_5.4-2.4~deb10u1.diff.gz
9f8fceda02483eae3742b065d4fed4cb6572684362e69217bbc63ce081045575 7002
libapache-mod-auth-kerb_5.4-2.4~deb10u1_amd64.buildinfo
Files:
5b4681cd754932cb4730a32913094162 1881 net optional
libapache-mod-auth-kerb_5.4-2.4~deb10u1.dsc
6dee48b3109008e0faa8aefef6ceea97 51231 net optional
libapache-mod-auth-kerb_5.4-2.4~deb10u1.diff.gz
4074a9e8b5defa5d18b393f7342d1d69 7002 net optional
libapache-mod-auth-kerb_5.4-2.4~deb10u1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEYQsotVz8/kXqG1Y7MRa6Xp/6aaMFAl3GCRUACgkQMRa6Xp/6
aaNiGQ/+MJ4cHyJYLzDkMU6WhpfhUaUNtRbVL24wyczI2pJgm7F9K6Z0fZJtYvC1
zVJpxZVOWauSHVBsTYh+Rd4VIJffhvV7UTAL2Y0J6wVrEVkA2C/tIi/u1vASRrnT
H81rgUy+cn814MIHusC4scLmroeLZSlGHIWb6UIQ5KAWDbropEtvZj2rQd3kt/C4
lsomwxdbu/ycSReMpBrKBMvtQXVrMjIqwNtiyahBi6M9gJ0KkgpNXZFGEOEc0ZdL
l9tywaqX/P8PzA9/VbIov9BtKDZawAIGgbT61fqPBFQo5K6/v5YP6MjJ8tp/KmZr
/AFCLIxWwP3+4SYsMqXHFeSaBMohL4zfJbr3IrdQZVpeZogtQeti0dbvBMbzh22i
BQQf+2P4WSceY5EIrk6Z3IOONJgHQuR4U3vKZtTFbeCq6ovZDrjX+gJZBxHOof2S
G03kzGC3nS/Zvd6aK68zlKlP27SnYV4US8wZM+i8Hc7C1yfwT7S6XfEm3ZlnM0CJ
Fg3qS0GN7AoX2TJCCCE1i+UVOU4E+3Wx5BhtUn+laMiEKBTBXaS2+chnG60sN8yF
695XJ/DonSRwhRQfdKdiK0UHyCZX+nNH3ApFhCP+lJ+MmdUJ/exSguXZ1ulTzgu5
gxhABVKW0kLUk/llOvb/9A/aCh725P2CgADdmCew9qBlov34uGY=
=CrS6
-----END PGP SIGNATURE-----
--- End Message ---
