The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2, and 1.8 alpha, allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid (1) AS-REQ or (2) TGS-REQ request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Kerberos | — | Upgrade macOS to the latest version | Dec 16, 2011 | Feb 22, 2010 |
| Debian | — | Upgrade krb5 | Jul 30, 2024 | Feb 22, 2010 |
| Freebsd | — | Upgrade krb5 | Dec 10, 2025 | Apr 19, 2010 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | Oct 30, 2017 | Feb 22, 2010 |
| Suse | — | Upgrade krb5-develUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-clientUpgrade krb5-serverUpgrade krb5Upgrade krb5-plugin-kdb-ldapUpgrade krb5-plugin-preauth-otpUpgrade krb5-plugin-preauth-spakeUpgrade krb5-docUpgrade krb5-32bit | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade krb5-kdcUpgrade libgssapi-krb5-2 | Nov 8, 2024 | Feb 22, 2010 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub