CVE-2020-25719 tests/krb5: Add expected parameters to cache key for obtaining tickets
authorJoseph Sutton <josephsutton@catalyst.net.nz>
Tue, 26 Oct 2021 22:18:36 +0000 (11:18 +1300)
committerJoseph Sutton <josephsutton@catalyst.net.nz>
Thu, 4 Nov 2021 03:58:10 +0000 (16:58 +1300)
commitb727d380028f7e54b8530dd7cd187a5d3ca0d4f9
tree644b83b55596780d7c2e3fe0ac085f9eede41b06
parentde5c2f6b5ca31d88941ffdee6622c4331bedd784
CVE-2020-25719 tests/krb5: Add expected parameters to cache key for obtaining tickets

If multiple calls to get_tgt() or get_service_ticket() specify different
expected parameters, we want to perform the request again so that the
checking can be performed, rather than reusing a previously obtained
ticket and potentially skipping checks.

It should be fine to cache tickets with the same expected parameters, as
tickets that fail to be obtained will not be stored in the cache, so the
checking will happen for every call.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14561

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
python/samba/tests/krb5/kdc_base_test.py