REDHAT-BUG-1551083: Low severity MIT krb5 vulnerability
A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user with permission to add principals to an LDAP Kerberos database can cause a null dereference in kadmind, or circumvent a DN container check, by supplying tagged data intended to be internal to the database module.
Reference: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869
Upstream patch: https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MIT krb5 (krb5/kadmin/kadmind)to a version that resolves this vulnerability.Fixed in 1.6Patch e1caf6fb74981da62039846931ebdffed71309d1
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1551083?
The severity of REDHAT-BUG-1551083 is classified as critical due to its potential to cause a null dereference in kadmind.
How do I fix REDHAT-BUG-1551083?
To fix REDHAT-BUG-1551083, update to the latest version of MIT krb5 as specified in the security advisory.
Who is affected by REDHAT-BUG-1551083?
Users of MIT krb5 version 1.6 or later who utilize LDAP for the Kerberos database and have kadmin access are affected by REDHAT-BUG-1551083.
What are the risks associated with REDHAT-BUG-1551083?
The risks associated with REDHAT-BUG-1551083 include possible denial of service and data integrity issues due to the ability to circumvent DN container checks.
When was REDHAT-BUG-1551083 disclosed?
REDHAT-BUG-1551083 was disclosed in October 2018.