CVE-2023-36054: Medium severity kerberos vulnerability
lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because xdrkadm5principalentrec does not validate the relationship between nkeydata and the keydata array count.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-36054?
CVE-2023-36054 is a vulnerability in MIT Kerberos 5 that allows a remote authenticated user to trigger a kadmind crash by exploiting an uninitialized pointer.
How severe is CVE-2023-36054?
CVE-2023-36054 has a severity rating of medium, with a CVSS score of 6.5.
What software versions are affected by CVE-2023-36054?
MIT Kerberos 5 versions before 1.20.2 and 1.21.x before 1.21.1 are affected by CVE-2023-36054.
How can a remote authenticated user exploit CVE-2023-36054?
A remote authenticated user can exploit CVE-2023-36054 by triggering a kadmind crash through the exploitation of an uninitialized pointer.
Are there any fixes or patches available for CVE-2023-36054?
Yes, fixes and patches are available for CVE-2023-36054. It is recommended to update to MIT Kerberos 5 version 1.20.2 or 1.21.1 to address this vulnerability.