CVE-2021-36222: Null Pointer Dereference
ecverify in kdc/kdcpreauthec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/krb5to a version that resolves this vulnerability.Fixed in 1.18.3-6Fixed in 1.17-3+deb10u2 - Upgrade
Upgrade
debian/krb5to a version that resolves this vulnerability.Fixed in 1.17-3+deb10u4Fixed in 1.17-3+deb10u5Fixed in 1.18.3-6+deb11u4Fixed in 1.18.3-6+deb11u3Fixed in 1.20.1-2+deb12u1Fixed in 1.20.1-4
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2021-36222.
What is the severity of CVE-2021-36222?
The severity of CVE-2021-36222 is high with a severity value of 7.5.
Which software is affected by CVE-2021-36222?
MIT Kerberos 5 before 1.18.4 and 1.19.x before 1.19.2 are affected by CVE-2021-36222.
How can remote attackers exploit CVE-2021-36222?
Remote attackers can exploit CVE-2021-36222 to cause a NULL pointer dereference and daemon crash.
Where can I find more information about CVE-2021-36222?
You can find more information about CVE-2021-36222 on the MIT Kerberos 5 GitHub page and the NetApp security advisory page.