CVE-2019-14844: High severity kerberos vulnerability
Published Sep 26, 2019
·Updated
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC.
Affected Software
4 affected components
MIT Kerberos 5>=1.16.1<=1.17.1
fedoraproject fedora=29
fedoraproject fedora=30
fedoraproject fedora=31
Remediation
Patch Available
Patch Available
Event History
Sep 26, 2019
CVE Published
via MITRE·11:50 AM
Data Sourced
via MITRE·11:50 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is CVE-2019-14844?
CVE-2019-14844 is a vulnerability found in Fedora versions of krb5 from 1.16.1 to including 1.17.x.
2
How does CVE-2019-14844 impact the Kerberos Key Distribution Center (KDC)?
CVE-2019-14844 can crash the KDC if a remote unauthenticated user sends one of the RFC 4556 "enctypes".
3
Which software versions are affected by CVE-2019-14844?
CVE-2019-14844 affects Fedora versions 29, 30, and 31, as well as MIT Kerberos 5 versions from 1.16.1 to including 1.17.x.
4
What is the severity of CVE-2019-14844?
CVE-2019-14844 has a severity rating of 7.5 (high).
5
How can I fix CVE-2019-14844?
To fix CVE-2019-14844, update to a version of krb5 that is not vulnerable.