In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdal | Nov 8, 2019 | May 15, 2019 |
| Debian | — | Upgrade heimdal | Jun 4, 2019 | May 15, 2019 |
| Suse | — | Upgrade libheimdal-develUpgrade libheimdal | Jul 2, 2019 | May 15, 2019 |
| Ubuntu | — | Upgrade libkrb5-26-heimdalUpgrade libkdc2-heimdalUpgrade heimdal-kdcUpgrade heimdal-clientsUpgrade heimdal-servers-x (Ubuntu Pro)Upgrade heimdal-kdc (Ubuntu Pro)Upgrade heimdal-clients (Ubuntu Pro)Upgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade libkdc2-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdalUpgrade heimdal-servers (Ubuntu Pro)Upgrade heimdal-kcmUpgrade heimdal-serversUpgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade heimdal-kcm (Ubuntu Pro)Upgrade heimdal-clients-x (Ubuntu Pro) | Oct 14, 2022 | May 15, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub