Fixes for CVE-2025-59088 and CVE-2025-59089 #68
Merged
+1,196
−112
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
In Application.__handle_recv(), the next part of the TCP exchange is received and queued to the io.BytesIO stream. Then, the content of the stream was systematically exported to a buffer. However, this buffer is only used if the data transfer is finished, causing a waste of processing resources if the message is received in multiple parts. On top of these unnecessary operations, this function does not handle length limits properly: it accepts to receive chunks of data with both an individual and total length larger than the maximum theoretical length of a Kerberos message, and will continue to wait for data as long as the input stream's length is not exactly the same as the one provided in the header of the response (even if the stream is already longer than the expected length). If the kdcproxy service is not protected against DNS discovery abuse, the attacker could take advantage of these problems to operate a denial-of-service attack (CVE-2025-59089). After this commit, kdcproxy will interrupt the receiving of a message after it exceeds the maximum length of a Kerberos message or the length indicated in the message header. Also it will only export the content of the input stream to a buffer once the receiving process has ended. Signed-off-by: Julien Rische <jrische@redhat.com>
Allowing the use of DNS discovery for any requested realm (i.e. querying SRV records from the DNS zone matching the realm name) created a server-side request forgery vulnerability (CVE-2025-59088). An attacker could take advantage of a DNS zone they control to have kdcproxy direct their request to any IP addresses (including loopback and internal network) and port, allowing network and firewall rules probing, and data exfiltration. This commit mitigates this risk by making the global "use_dns" parameter apply only to realms declared in the kdcproxy configuration, and other configurations if their modules are enabled. To accommodate cases where realm hierarchies (like AD forests) are proxied, support for wildcards is added for realm section names. This can be used to have any "sub-realm" considered known, and therefore allowed to use DNS to discover their KDCs. The new "dns_realm_discovery" parameter can be enabled (if "use_dns" is not globally disabled) to allow use of DNS discovery for unknown realms too, restoring the previous unsafe behavior. For any KDC address obtained by DNS discovery, a warning is logged if the port is not a standard Kerberos port. This warning can be silenced using the "silence_port_warn" configuration parameter. Signed-off-by: Julien Rische <jrische@redhat.com>
Signed-off-by: Julien Rische <jrische@redhat.com>
jrisc
changed the title
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes two vulnerabilities:
[*EXAMPLE.COM]) to handle realm hierarchies (like AD forests)dns_realm_discoverysettingsilence_port_warnsetting)Also remove outdated MIT license classifier, enable tests for Python 3.12 and 3.14, add missing test dependencies, and do not re-enable implicitly ignored conflicting Flake8 constraints (line breaks before AND after binary operators).
Given the fact this PR has a significant impact on how the configuration of kdcproxy works, it would probably make sense to make it part of a new release.