Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 150

Export CSV
CVE-2010-4020

krb5: krb5 may accept authdata checksums with low-entropy derived keys (MITKRB5-SA-2010-007)

MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2) AD-KDC-ISSUED signature, and possibly gain privileges, by leveraging the small key space that results from certain one-byte stream-cipher operations.

CVSS 3.0 · 6.3 Medium EPSS 1.9% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2010-1324

krb5: multiple checksum handling vulnerabilities (MITKRB5-SA-2010-007)

MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain privileges, or have unspecified other impact via (1) an unkeyed checksum, (2) an unkeyed PAC checksum, or (3) a KrbFastArmoredReq checksum based on an RC4 key.

CVSS 3.0 · 3.7 Low EPSS 2.3% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux
CVE-2023-36054

krb5: Denial of service through freeing uninitialized pointer

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

CVSS 3.1 · 6.5 Medium EPSS 2.8% KEV · Not listed
Vendors
Debian Mit Netapp and 1 more
Products
Debian Linux Kerberos 5 Active Iq Unified Manager and 5 more
CVE-2022-39028

krb5-appl: NULL pointer dereference

telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, if the telnetd application has many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.

CVSS 3.1 · 7.5 High EPSS 2.3% KEV · Not listed
Vendors
Debian Gnu Mit and 1 more
Products
Debian Linux Inetutils Kerberos 5 and 1 more
CVE-2019-14844

krb5: reversed strlcpy() allows client to crash the KDC

A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes". A remote unauthenticated user could use this flaw to crash the KDC.

CVSS 3.1 · 7.5 High EPSS 4.4% KEV · Not listed
Vendors
Fedoraproject Mit
Products
Fedora Kerberos 5
CVE-2018-5710

krb5: null pointer deference in strlen function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.

CVSS 3.0 · 6.5 Medium EPSS 1.8% KEV · Not listed
Vendors
Mit
Products
Kerberos
CVE-2018-5709

krb5: integer overflow in dbentry->n_key_data in kadmin/dbutil/dump.c

An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect other artifacts of the database as we know that a Kerberos database dump file contains trusted data.

CVSS 3.0 · 7.5 High EPSS 2.0% KEV · Not listed
Vendors
Mit
Products
Kerberos
CVE-2018-20217

krb5: Reachable assertion in the KDC using S4U2Self requests

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

CVSS 3.1 · 5.3 Medium EPSS 1.4% KEV · Not listed
Vendors
Debian Mit Redhat
Products
Debian Linux Kerberos Ansible Tower and 1 more
CVE-2017-7562

krb5: Authentication bypass by improper validation of certificate EKU and SAN

An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed
Vendors
Mit Redhat
Products
Kerberos 5 Enterprise Linux Enterprise Linux Desktop and 2 more