The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade krb5-server-ldapUpgrade krb5-serverUpgrade krb5-libsUpgrade krb5-workstationUpgrade krb5-devel | Dec 1, 2016 | Aug 14, 2014 |
| Debian | — | Upgrade krb5 | Jul 30, 2024 | Aug 14, 2014 |
| F5 Big Ip | — | Update F5 BIG-IP to the latest version | Jun 17, 2026 | Sep 4, 2014 |
| Oracle_linux | — | Upgrade krb5-pkinitUpgrade krb5-develUpgrade krb5-libsUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade krb5-workstation | Oct 16, 2024 | Aug 14, 2014 |
| Suse | — | Upgrade krb5Upgrade krb5-serverUpgrade krb5-apps-serversUpgrade krb5-docUpgrade krb5-plugin-preauth-otpUpgrade krb5-x86Upgrade krb5-apps-clientsUpgrade krb5-plugin-kdb-ldapUpgrade krb5-32bitUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-develUpgrade krb5-devel-32bitUpgrade krb5-client | Dec 18, 2015 | Aug 11, 2014 |
| Ubuntu | — | Upgrade libkadm5clnt-mit8Upgrade krb5-kdc-ldapUpgrade libk5crypto3Upgrade libkadm5srv-mit8Upgrade krb5-kdcUpgrade libkdb5-4Upgrade krb5-pkinitUpgrade libkadm5srv-mit9Upgrade libkrad0Upgrade krb5-admin-serverUpgrade libkdb5-6Upgrade libkadm5srv-mit7Upgrade libkdb5-7Upgrade krb5-userUpgrade libgssapi-krb5-2Upgrade libkrb5-3Upgrade libkadm5clnt-mit7Upgrade libkrb5support0Upgrade libkadm5clnt-mit9Upgrade krb5-otpUpgrade libgssrpc4 | Nov 8, 2024 | Aug 14, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub