Need suggestion/help in back porting the fix for vulnerability CVE-2017-7562 (backporting from Kerberos 1.16.1 to Kerberos 1.9)

[Shivakumar Nadarajan -X (shinadar - HCL TECHNOLOGIES LIMITED at Cisco)]

Hi Greg,

	Thanks for your interest in this issue. But I am still not clear that how this vulnerability is not applicable to kerberos 1.9 .
Because as per the git link https://github.com/krb5/krb5/pull/694 it seems that this functionality is present in kerberos 1.9 also.

Please can you help in elaborate more on how the fix is not applicable for kerberos 1.9

Thanks and Regards!
Shiva

-----Original Message-----
From: Greg Hudson [mailto:ghudson at mit.edu] 
Sent: 21 September 2018 19:48
To: Shivakumar Nadarajan -X (shinadar - HCL TECHNOLOGIES LIMITED at Cisco) <shinadar at cisco.com>; krbdev at mit.edu
Subject: Re: Need suggestion/help in back porting the fix for vulnerability CVE-2017-7562 (backporting from Kerberos 1.16.1 to Kerberos 1.9)

On 09/21/2018 02:04 AM, Shivakumar Nadarajan -X (shinadar - HCL TECHNOLOGIES LIMITED at Cisco) wrote:> We are using Kerberos (version
1.9) in one of our components. We came across the vulnerability
CVE-2017-7562 being reported and fixed in Kerberos 1.16.1.

CVE-2017-7562 does not apply to version 1.9, so you should not need to address it.

This vulnerability actually never appeared in any released version of MIT krb5.  It was introduced on the master branch and then fixed before the release of 1.16.  The CVE was assigned because the Fedora package contained a backport of the feature before it was fixed.