USN-6947-1: Kerberos vulnerabilities
Published Aug 8, 2024
·Updated
It was discovered that Kerberos incorrectly handled GSS message tokens where an unwrapped token could appear to be truncated. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-37370) It was discovered that Kerberos incorrectly handled GSS message tokens when sent a token with invalid length fields. An attacker could possibly use this issue to cause a denial of service. (CVE-2024-37371)
Affected Software
182 affected componentsFixes available
All of the following
ubuntu/krb5-admin-server<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/krb5-kdc<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/krb5-kdc-ldap<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/krb5-otp<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/krb5-pkinit<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/krb5-user<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libgssapi-krb5-2<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libgssrpc4t64<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libk5crypto3<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libkadm5clnt-mit12<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libkadm5srv-mit12<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libkdb5-10t64<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libkrad0<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libkrb5-3<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/libkrb5support0<1.20.1-6ubuntu2.1
1.20.1-6ubuntu2.1
Ubuntu Ubuntu=24.04
All of the following
ubuntu/krb5-admin-server<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/krb5-kdc<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/krb5-kdc-ldap<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/krb5-otp<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/krb5-pkinit<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/krb5-user<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libgssapi-krb5-2<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libgssrpc4<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libk5crypto3<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libkadm5clnt-mit12<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libkadm5srv-mit12<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libkdb5-10<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libkrad0<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libkrb5-3<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/libkrb5support0<1.19.2-2ubuntu0.4
1.19.2-2ubuntu0.4
Ubuntu Ubuntu=22.04
All of the following
ubuntu/krb5-admin-server<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/krb5-kdc<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/krb5-kdc-ldap<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/krb5-otp<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/krb5-pkinit<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/krb5-user<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libgssapi-krb5-2<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libgssrpc4<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libk5crypto3<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libkadm5clnt-mit11<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libkadm5srv-mit11<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libkdb5-9<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libkrad0<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libkrb5-3<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/libkrb5support0<1.17-6ubuntu4.6
1.17-6ubuntu4.6
Ubuntu Ubuntu=20.04
All of the following
ubuntu/krb5-admin-server<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/krb5-kdc<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/krb5-kdc-ldap<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/krb5-otp<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/krb5-pkinit<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/krb5-user<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libgssapi-krb5-2<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libgssrpc4<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libk5crypto3<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libkadm5clnt-mit11<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libkadm5srv-mit11<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libkdb5-9<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libkrad0<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libkrb5-3<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/libkrb5support0<1.16-2ubuntu0.4+esm2
1.16-2ubuntu0.4+esm2
Ubuntu Ubuntu=18.04
All of the following
ubuntu/krb5-admin-server<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/krb5-kdc<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/krb5-kdc-ldap<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/krb5-otp<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/krb5-pkinit<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/krb5-user<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libgssapi-krb5-2<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libgssrpc4<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libk5crypto3<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libkadm5clnt-mit9<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libkadm5srv-mit9<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libkdb5-8<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libkrad0<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libkrb5-3<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/libkrb5support0<1.13.2+dfsg-5ubuntu2.2+esm5
1.13.2+dfsg-5ubuntu2.2+esm5
Ubuntu Ubuntu=16.04
All of the following
ubuntu/krb5-admin-server<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/krb5-kdc<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/krb5-kdc-ldap<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/krb5-otp<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/krb5-pkinit<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/krb5-user<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libgssapi-krb5-2<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libgssrpc4<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libk5crypto3<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libkadm5clnt-mit9<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libkadm5srv-mit8<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libkadm5srv-mit9<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libkdb5-7<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libkrad0<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libkrb5-3<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
All of the following
ubuntu/libkrb5support0<1.12+dfsg-2ubuntu5.4+esm5
1.12+dfsg-2ubuntu5.4+esm5
Ubuntu Ubuntu=14.04
Event History
Aug 8, 2024
Advisory Published
via Ubuntu·12:00 AM
Frequently Asked Questions
1
What is the severity of USN-6947-1?
The severity of USN-6947-1 is classified as a potential denial-of-service vulnerability due to improper handling of GSS message tokens in Kerberos.
2
How do I fix USN-6947-1?
To fix USN-6947-1, you should upgrade to the patched version of the affected packages, specifically 1.20.1-6ubuntu2.1 or a later version for Ubuntu 24.04.
3
Which packages are affected by USN-6947-1?
The affected packages for USN-6947-1 include krb5-admin-server, krb5-kdc, krb5-user, and various libkrb5 and libgssapi libraries.
4
What systems are affected by USN-6947-1?
USN-6947-1 affects Ubuntu versions 24.04 and 22.04 based on the specific package versions listed.
5
What should I do if I can't update for USN-6947-1?
If you cannot update due to compatibility issues, consider implementing temporary network segmentation to mitigate risk until an update can be applied.