Latest mit kerberos 5 Vulnerabilities

● CVE-2023-39975

kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copi...

MIT Kerberos 5>=1.21<1.21.2

● CVE-2023-36054

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs becaus...

MIT Kerberos 5<1.20.2

MIT Kerberos 5=1.21

MIT Kerberos 5=1.21-beta1

Debian Debian Linux=10.0

Apple iPadOS

NetApp Clustered Data ONTAP=9.0

and 3 more

● CVE-2022-42898

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) ...

MIT Kerberos 5>=1.8<1.19.4

MIT Kerberos 5=1.20

MIT Kerberos 5=1.20-beta1

Heimdal Project Heimdal<7.7.1

Samba Samba<4.15.12

Samba Samba>=4.16.0<4.16.7

and 4 more

● CVE-2022-39028

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application wo...

debian/inetutils<=2:1.9.4-7+deb10u1

ubuntu/inetutils<2:1.9.4-11ubuntu0.2

ubuntu/inetutils<2:2.2-2ubuntu0.1

ubuntu/inetutils<2:2.3-5

GNU inetutils<=2.3

MIT Kerberos 5<=1.0.3

and 2 more

● CVE-2021-36222

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference a...

debian/krb5<=1.17-3+deb10u1<=1.17-3<=1.18.3-5

debian/krb5

MIT Kerberos 5<1.18.4

MIT Kerberos 5>=1.19.0<1.19.2

Debian Debian Linux=10.0

Apple iPadOS

and 5 more

● CVE-2020-28196

MIT Kerberos 5 (aka krb5) is vulnerable to a denial of service, caused by an unbounded recursion flaw in lib/krb5/asn.1/asn1_encode.c. By sending a specially-crafted ASN.1-encoded Kerberos message, a ...

redhat/krb5<0:1.18.2-8.el8

redhat/redhat-virtualization-host<0:4.4.6-20210527.3.el8_4

MIT Kerberos 5<1.17.2

MIT Kerberos 5>=1.18.0<1.18.3

Fedoraproject Fedora=31

Apple iPadOS

and 13 more

● CVE-2019-14844

A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user...

MIT Kerberos 5>=1.16.1<=1.17.1

Fedoraproject Fedora=29

Fedoraproject Fedora=30

Fedoraproject Fedora=31

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.