diff options
| author | Joseph Sutton <josephsutton@catalyst.net.nz> | 2022-05-30 19:18:17 +1200 |
|---|---|---|
| committer | Jule Anger <janger@samba.org> | 2022-07-27 10:52:36 +0000 |
| commit | ffb599050ae2c1b9d0746addfdac1e41866aa819 (patch) | |
| tree | 5006885005016201f20a76ff93a958b74174903f /python | |
| parent | 018bdbc29db035e14019f0f58aba035cc86b534e (diff) | |
| download | samba-ffb599050ae2c1b9d0746addfdac1e41866aa819.tar.gz samba-ffb599050ae2c1b9d0746addfdac1e41866aa819.tar.bz2 samba-ffb599050ae2c1b9d0746addfdac1e41866aa819.zip | |
CVE-2022-2031 s4:kdc: Reject tickets during the last two minutes of their life
For Heimdal, this now matches the behaviour of Windows. The object of
this requirement is to ensure we don't allow kpasswd tickets, not having
a lifetime of more than two minutes, to be passed off as TGTs.
An existing requirement for TGTs to contain a REQUESTER_SID PAC buffer
suffices to prevent kpasswd ticket misuse, so this is just an additional
precaution on top.
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15047
Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andreas Schneider <asn@samba.org>
Diffstat (limited to 'python')
0 files changed, 0 insertions, 0 deletions