The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2, and 1.8 alpha, allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid (1) AS-REQ or (2) TGS-REQ request.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Kerberos | — | Upgrade macOS to the latest version | Dec 16, 2011 | Feb 22, 2010 |
| Debian | — | Upgrade krb5 | Jul 30, 2024 | Feb 22, 2010 |
| Freebsd | — | Upgrade krb5 | Dec 10, 2025 | Apr 19, 2010 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | Oct 30, 2017 | Feb 22, 2010 |
| Suse | — | Upgrade krb5-serverUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-develUpgrade krb5-clientUpgrade krb5-plugin-preauth-spakeUpgrade krb5-32bitUpgrade krb5Upgrade krb5-plugin-preauth-otpUpgrade krb5-docUpgrade krb5-plugin-kdb-ldap | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libgssapi-krb5-2Upgrade krb5-kdc | Nov 8, 2024 | Feb 22, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub