From: Stefan Metzmacher <metze@samba.org>
Date: Sun, 4 Dec 2022 20:05:39 +0000 (+0100)
Subject: CVE-2022-37966 s4:kdc: also limit the krbtgt history to their strongest keys
X-Git-Tag: talloc-2.4.0~297
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=6b46b764fc5760d3bf83bb1ea5fa398d993cf68d;p=thirdparty%2Fsamba.git

CVE-2022-37966 s4:kdc: also limit the krbtgt history to their strongest keys

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15237

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
---

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index 5e77cf6a4cf..9b78d8fe29f 100644
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -1521,6 +1521,8 @@ static krb5_error_code samba_kdc_message2entry(krb5_context context,
 			if (entry->etypes != NULL) {
 				entry->etypes->len = 1;
 			}
+			entry->old_keys.len = MIN(entry->old_keys.len, 1);
+			entry->older_keys.len = MIN(entry->older_keys.len, 1);
 		}
 #endif
 	} else if (kdc_db_ctx->rodc) {