PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-libsUpgrade krb5-pkinitUpgrade krb5-workstationUpgrade libkadm5Upgrade krb5-develUpgrade krb5-serverUpgrade krb5-server-ldap | Dec 6, 2022 | Nov 28, 2022 |
| Alpine Linux | — | Upgrade sambaUpgrade heimdalUpgrade krb5 | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade krb5-debuginfoUpgrade krb5-workstationUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-develUpgrade krb5-pkinit | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade krb5 | Jan 25, 2023 | Nov 5, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade krb5-pkinit-opensslUpgrade krb5-devel-debuginfoUpgrade krb5-develUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-debuginfoUpgrade krb5-pkinitUpgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-server-ldapUpgrade krb5-debugsourceUpgrade krb5-pkinit-debuginfoUpgrade libkadm5Upgrade krb5-libsUpgrade krb5-serverUpgrade krb5-workstationUpgrade libkadm5-debuginfo | Nov 29, 2022 | Nov 28, 2022 |
| Debian | — | Upgrade sambaUpgrade krb5Upgrade heimdal | Nov 21, 2022 | Nov 21, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade krb5-119Upgrade krb5-120Upgrade krb5-develUpgrade mysql57-serverUpgrade mysql80-serverUpgrade mysql-connector-c++Upgrade mysql-connector-jUpgrade mysql-connector-odbcUpgrade krb5Upgrade FreeBSD | Nov 16, 2022 | Nov 15, 2022 |
| Gentoo Linux | — | Upgrade net-fs/samba.Upgrade app-crypt/mit-krb5.Upgrade app-crypt/heimdal. | Sep 18, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade krb5-libsUpgrade krb5-serverUpgrade krb5-clientUpgrade krb5 | Feb 13, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade libwbclientUpgrade samba-commonUpgrade sambaUpgrade libsmbclientUpgrade samba-clientUpgrade samba-libsUpgrade samba-winbind-clientsUpgrade samba-winbind-modulesUpgrade samba-winbindUpgrade samba-common-tools | Mar 8, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade samba-libsUpgrade samba-pythonUpgrade samba-winbindUpgrade samba-client-libsUpgrade sambaUpgrade libwbclientUpgrade samba-common-toolsUpgrade libsmbclientUpgrade samba-commonUpgrade samba-common-libsUpgrade samba-winbind-modulesUpgrade samba-clientUpgrade samba-winbind-clients | Jun 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-libsUpgrade python3-sambaUpgrade samba-testUpgrade samba-pidlUpgrade ctdb-testsUpgrade samba-krb5-printingUpgrade samba-client-libsUpgrade libwbclientUpgrade python2-samba-testUpgrade libsmbclientUpgrade python3-samba-testUpgrade samba-winbind-modulesUpgrade samba-winbind-krb5-locatorUpgrade samba-dc-libsUpgrade samba-winbindUpgrade samba-common-libsUpgrade python2-sambaUpgrade samba-clientUpgrade samba-winbind-clientsUpgrade samba-common-toolsUpgrade ctdbUpgrade sambaUpgrade samba-commonUpgrade samba-test-libs | Feb 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade krb5Upgrade krb5-clientUpgrade krb5-serverUpgrade krb5-libs | Jan 9, 2023 | Dec 25, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 11, 2023 |
| Oracle_linux | — | Upgrade krb5-libsUpgrade krb5-develUpgrade krb5-workstationUpgrade krb5-server-ldapUpgrade libkadm5Upgrade krb5-serverUpgrade krb5-pkinit-opensslUpgrade krb5-pkinit | Nov 29, 2022 | Nov 15, 2022 |
| Redhat_linux | — | Upgrade krb5-server-ldapUpgrade krb5-workstationUpgrade libkadm5Upgrade libkadm5-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade krb5-libs-debuginfoUpgrade krb5-libsUpgrade krb5-debugsourceUpgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-pkinitUpgrade krb5-devel-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-debuginfoUpgrade krb5-devel | Nov 29, 2022 | Nov 28, 2022 |
| Rocky_linux | — | Upgrade libkadm5Upgrade krb5-pkinitUpgrade krb5-develUpgrade krb5-serverUpgrade krb5-libs-debuginfoUpgrade libkadm5-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-libsUpgrade krb5-workstationUpgrade krb5-workstation-debuginfoUpgrade krb5-debuginfoUpgrade krb5-server-ldapUpgrade krb5-debugsourceUpgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-devel-debuginfo | Mar 12, 2024 | Dec 25, 2022 |
| Samba | — | Upgrade to Samba 4.17.3 or later.Upgrade to Samba 4.16.7 or later.Upgrade to Samba 4.15.12 or later. | Dec 25, 2022 | Dec 25, 2022 |
| Suse | — | Upgrade samba-libs-python3-64bitUpgrade libsl0Upgrade libgssapi3Upgrade samba-client-libs-32bitUpgrade libsamba-policy0-python3Upgrade samba-client-libsUpgrade libkdc2Upgrade ctdbUpgrade samba-libs-32bitUpgrade samba-dsdb-modulesUpgrade libsamba-policy0-python3-32bitUpgrade libhdb9Upgrade krb5Upgrade libhx509-5Upgrade libkafs0Upgrade krb5-devel-32bitUpgrade libsamba-policy0-python3-64bitUpgrade krb5-plugin-preauth-otpUpgrade samba-libsUpgrade libheimedit0Upgrade samba-testUpgrade krb5-plugin-preauth-spakeUpgrade libkadm5clnt7Upgrade krb5-clientUpgrade samba-client-32bitUpgrade krb5-develUpgrade samba-develUpgrade libkrb5-26Upgrade samba-devel-32bitUpgrade krb5-docUpgrade libasn1-8Upgrade krb5-32bitUpgrade libkadm5srv8Upgrade samba-winbind-libs-32bitUpgrade sambaUpgrade samba-libs-64bitUpgrade krb5-plugin-kdb-ldapUpgrade samba-libs-python3Upgrade libsamba-policy-python3-develUpgrade samba-ldb-ldapUpgrade samba-winbind-libsUpgrade samba-toolUpgrade libheimdal-develUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-mini-develUpgrade ctdb-pcp-pmdaUpgrade libroken18Upgrade samba-gpupdateUpgrade samba-python3Upgrade samba-ad-dc-libsUpgrade libotp0Upgrade samba-winbindUpgrade krb5-serverUpgrade samba-clientUpgrade samba-ad-dcUpgrade libheimntlm0Upgrade libsamba-policy-develUpgrade samba-docUpgrade libwind0Upgrade samba-libs-python3-32bitUpgrade libheimbase1Upgrade krb5-miniUpgrade samba-cephUpgrade libhcrypto4Upgrade samba-client-64bitUpgrade samba-ad-dc-libs-32bit | Nov 22, 2022 | Nov 21, 2022 |
| Ubuntu | — | Upgrade libhdb9-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdalUpgrade krb5-admin-serverUpgrade sambaUpgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade krb5-admin-server (Ubuntu Pro)Upgrade libasn1-8-heimdalUpgrade libkdb5-10Upgrade libhx509-5-heimdalUpgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade krb5-user (Ubuntu Pro)Upgrade libkdb5-7 (Ubuntu Pro)Upgrade samba (Ubuntu Pro)Upgrade krb5-userUpgrade libhdb9-heimdalUpgrade libkdb5-9Upgrade krb5-kdcUpgrade libgssapi3-heimdalUpgrade libgssapi-krb5-2 (Ubuntu Pro)Upgrade krb5-kdc (Ubuntu Pro)Upgrade libgssapi-krb5-2Upgrade libkdb5-8 (Ubuntu Pro) | Jan 13, 2023 | Nov 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub