REDHAT-BUG-1473560: Medium severity mit kerberos 5 vulnerability
It was found that in MIT krb5 1.7 and later, an authenticated attacker can cause an assertion failure in krb5kdc by sending an invalid S4U2Self or S4U2Proxy request.
Upstream patch:
https://github.com/krb5/krb5/pull/678/commits/ffb35baac698
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1473560?
The severity of REDHAT-BUG-1473560 is considered high due to the potential for an authenticated attacker to exploit the vulnerability.
How do I fix REDHAT-BUG-1473560?
To fix REDHAT-BUG-1473560, apply the patches provided in the upstream commit by updating to a version of MIT krb5 that includes the fix.
What impact does REDHAT-BUG-1473560 have on my system?
The impact of REDHAT-BUG-1473560 can result in an assertion failure, which may lead to a denial of service for the krb5kdc service.
Who is affected by REDHAT-BUG-1473560?
Any system running MIT krb5 version 1.7 or later is affected by REDHAT-BUG-1473560.
What are S4U2Self and S4U2Proxy requests related to REDHAT-BUG-1473560?
S4U2Self and S4U2Proxy requests are Kerberos extensions that allow service accounts to obtain tickets on behalf of users, and the vulnerability arises from improper handling of invalid requests.