A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade python3-ipatestsUpgrade krb5-libsUpgrade python3-kdcproxyUpgrade python3-qrcodeUpgrade ipa-client-epnUpgrade krb5-pkinitUpgrade slapi-nisUpgrade ipa-server-trust-adUpgrade ipa-selinuxUpgrade krb5-develUpgrade ipa-server-dnsUpgrade ipa-healthcheck-coreUpgrade ipa-healthcheckUpgrade krb5-workstationUpgrade python3-pyusbUpgrade libkadm5Upgrade custodiaUpgrade krb5-server-ldapUpgrade ipa-python-compatUpgrade krb5-serverUpgrade python3-yubicoUpgrade softhsmUpgrade opendnssecUpgrade python3-custodiaUpgrade python3-qrcode-coreUpgrade python3-ipaclientUpgrade softhsm-develUpgrade bind-dyndb-ldapUpgrade ipa-client-commonUpgrade python3-ipalibUpgrade ipa-serverUpgrade python3-jwcryptoUpgrade ipa-commonUpgrade python3-ipaserverUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade ipa-client | May 15, 2023 | Nov 11, 2020 |
| Amazon_linux | — | Upgrade samba | Dec 10, 2022 | Nov 11, 2020 |
| Amazon_linux_2023 | — | Upgrade samba-dcerpc-debuginfoUpgrade python3-samba-debuginfoUpgrade samba-ldb-ldap-modulesUpgrade samba-test-debuginfoUpgrade samba-libsUpgrade samba-winbind-clients-debuginfoUpgrade libnetapiUpgrade libsmbclientUpgrade samba-common-toolsUpgrade samba-clientUpgrade libwbclientUpgrade python3-samba-develUpgrade samba-krb5-printing-debuginfoUpgrade samba-usersharesUpgrade libwbclient-develUpgrade samba-ldb-ldap-modules-debuginfoUpgrade samba-winbind-krb5-locatorUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-client-debuginfoUpgrade samba-dcerpcUpgrade samba-client-libsUpgrade samba-krb5-printingUpgrade samba-winbind-debuginfoUpgrade python3-sambaUpgrade samba-common-tools-debuginfoUpgrade libsmbclient-develUpgrade samba-dc-libsUpgrade samba-test-libs-debuginfoUpgrade libsmbclient-debuginfoUpgrade samba-develUpgrade samba-winbind-modulesUpgrade samba-winbind-modules-debuginfoUpgrade samba-winbind-clientsUpgrade samba-vfs-iouring-debuginfoUpgrade libwbclient-debuginfoUpgrade samba-common-libs-debuginfoUpgrade sambaUpgrade samba-client-libs-debuginfoUpgrade samba-winbindUpgrade samba-common-libsUpgrade python3-samba-testUpgrade libnetapi-develUpgrade samba-debuginfoUpgrade samba-pidlUpgrade samba-libs-debuginfoUpgrade samba-test-libsUpgrade samba-testUpgrade samba-debugsourceUpgrade samba-vfs-iouringUpgrade samba-dc-libs-debuginfoUpgrade samba-commonUpgrade libnetapi-debuginfo | Feb 17, 2025 | Nov 10, 2020 |
| Centos_linux | — | Upgrade ipa-server-dnsUpgrade krb5-libsUpgrade python3-yubicoUpgrade slapi-nis-debugsourceUpgrade opendnssec-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-server-debuginfoUpgrade ipa-python-compatUpgrade krb5-pkinitUpgrade softhsmUpgrade softhsm-debugsourceUpgrade python3-kdcproxyUpgrade python3-qrcode-coreUpgrade krb5-develUpgrade krb5-workstationUpgrade ipa-client-debuginfoUpgrade opendnssec-debugsourceUpgrade ipa-debuginfoUpgrade ipa-client-commonUpgrade ipa-client-epnUpgrade python3-pyusbUpgrade python3-jwcryptoUpgrade softhsm-develUpgrade ipa-commonUpgrade python3-custodiaUpgrade slapi-nisUpgrade krb5-serverUpgrade krb5-server-debuginfoUpgrade libkadm5Upgrade libkadm5-debuginfoUpgrade ipa-clientUpgrade ipa-serverUpgrade opendnssecUpgrade krb5-libs-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldapUpgrade python3-ipalibUpgrade python3-ipaclientUpgrade ipa-server-commonUpgrade python3-qrcodeUpgrade custodiaUpgrade krb5-server-ldap-debuginfoUpgrade python3-ipatestsUpgrade slapi-nis-debuginfoUpgrade ipa-healthcheckUpgrade softhsm-debuginfoUpgrade krb5-debugsourceUpgrade ipa-debugsourceUpgrade ipa-healthcheck-coreUpgrade bind-dyndb-ldap-debugsourceUpgrade krb5-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-ipaserverUpgrade bind-dyndb-ldapUpgrade ipa-selinuxUpgrade krb5-pkinit-debuginfoUpgrade ipa-client-sambaUpgrade ipa-server-trust-ad | May 15, 2023 | Nov 11, 2020 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Nov 11, 2020 |
| Msft | — | 2021-07 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB5004238)2021-07 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5004244)2020-11 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB4586823)2020-12 Security Only Quality Update for Windows 7 for x64-based Systems (KB4592503)2020-11 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4586786)2021-04 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB5001337)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB4592503)2020-12 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB4592504)2021-07 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5004307)2021-07 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5004299)2021-04 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5001332)2021-07 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5004299)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB4586808)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5001383)2021-04 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5001332)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB4592503)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5001392)2020-11 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB4586786)2020-12 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB4592504)2021-07 Security Only Quality Update for Windows 7 for x86-based Systems (KB5004307)2020-12 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5004302)2021-04 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5001393)2021-04 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5001392)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5004302)2021-04 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5001330)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5004307)2021-07 Cumulative Update for Microsoft Windows Server 2012 (KB5004302)2020-11 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB4586781)2021-07 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5004285)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5001383)2020-12 Security Only Quality Update for Windows 7 for x86-based Systems (KB4592503)2020-11 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB4586781)2020-11 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB4586823)2021-07 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5004285)2021-07 Security Only Quality Update for Windows 7 for x64-based Systems (KB5004307)2021-07 Cumulative Update for Microsoft Windows Server 2012 R2 (KB5004285)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5001392)2021-07 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5004237)2021-07 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5004237)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB4586808)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5004307)2021-04 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5001330)2021-04 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5001393) | Nov 10, 2020 | Nov 10, 2020 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.13.14-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/samba/libsmbclient to version 4.13.8-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Nov 11, 2020 |
| Oracle_linux | — | Upgrade python3-qrcode-coreUpgrade python3-ipaserverUpgrade libkadm5Upgrade python3-qrcodeUpgrade ipa-client-epnUpgrade ipa-server-dnsUpgrade ipa-client-sambaUpgrade krb5-pkinitUpgrade krb5-server-ldapUpgrade python3-ipaclientUpgrade bind-dyndb-ldapUpgrade opendnssecUpgrade python3-custodiaUpgrade ipa-python-compatUpgrade krb5-libsUpgrade krb5-develUpgrade softhsmUpgrade python3-jwcryptoUpgrade ipa-healthcheck-coreUpgrade softhsm-develUpgrade python3-yubicoUpgrade ipa-clientUpgrade krb5-serverUpgrade ipa-serverUpgrade python3-ipatestsUpgrade ipa-commonUpgrade ipa-client-commonUpgrade python3-kdcproxyUpgrade ipa-selinuxUpgrade krb5-workstationUpgrade slapi-nisUpgrade python3-pyusbUpgrade ipa-server-trust-adUpgrade custodiaUpgrade ipa-server-commonUpgrade ipa-healthcheckUpgrade python3-ipalib | May 17, 2023 | Nov 10, 2020 |
| Redhat_linux | — | Upgrade softhsm-debugsourceUpgrade krb5-devel-debuginfoUpgrade ipa-selinuxUpgrade opendnssec-debugsourceUpgrade ipa-healthcheckUpgrade ipa-server-dnsUpgrade krb5-server-ldap-debuginfoUpgrade python3-pyusbUpgrade krb5-debugsourceUpgrade ipa-client-sambaUpgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldapUpgrade python3-kdcproxyUpgrade python3-ipaclientUpgrade custodiaUpgrade ipa-healthcheck-coreUpgrade krb5-workstation-debuginfoUpgrade ipa-client-epnUpgrade python3-qrcodeUpgrade bind-dyndb-ldapUpgrade krb5-libsUpgrade ipa-server-commonUpgrade ipa-debugsourceUpgrade bind-dyndb-ldap-debugsourceUpgrade softhsm-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-jwcryptoUpgrade krb5-pkinitUpgrade slapi-nis-debugsourceUpgrade ipa-debuginfoUpgrade python3-yubicoUpgrade ipa-commonUpgrade softhsmUpgrade ipa-python-compatUpgrade libkadm5Upgrade krb5-develUpgrade ipa-clientUpgrade python3-ipaserverUpgrade ipa-server-debuginfoUpgrade krb5-serverUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-serverUpgrade opendnssecUpgrade ipa-client-commonUpgrade slapi-nisUpgrade krb5-libs-debuginfoUpgrade ipa-client-debuginfoUpgrade opendnssec-debuginfoNo solution existsUpgrade krb5-debuginfoUpgrade python3-custodiaUpgrade krb5-server-debuginfoUpgrade python3-ipatestsUpgrade krb5-workstationUpgrade softhsm-develUpgrade python3-qrcode-coreUpgrade ipa-server-trust-adUpgrade libkadm5-debuginfoUpgrade slapi-nis-debuginfoUpgrade python3-ipalib | May 15, 2023 | Nov 11, 2020 |
| Rocky_linux | — | Upgrade slapi-nisUpgrade softhsm-debuginfoUpgrade opendnssec-debuginfoUpgrade slapi-nis-debugsourceUpgrade slapi-nis-debuginfoUpgrade opendnssecUpgrade softhsm-debugsourceUpgrade opendnssec-debugsourceUpgrade softhsm-develUpgrade softhsm | Aug 15, 2024 | Nov 11, 2020 |
| Suse | — | Upgrade samba-libs-32bitUpgrade samba-libs-python3Upgrade samba-ldb-ldapUpgrade samba-python3Upgrade samba-ad-dc-libsUpgrade samba-client-libsUpgrade samba-dsdb-modulesUpgrade sambaUpgrade samba-winbind-libsUpgrade samba-winbindUpgrade samba-cephUpgrade libsamba-policy0-python3Upgrade samba-libsUpgrade samba-develUpgrade samba-clientUpgrade libsamba-policy-python3-develUpgrade libsamba-errors-develUpgrade samba-winbind-libs-32bitUpgrade libsamba-policy-develUpgrade samba-client-32bitUpgrade libsamba-errors0Upgrade samba-client-libs-32bitUpgrade samba-gpupdate | Aug 9, 2024 | Nov 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub