The spnego_gss_accept_sec_context function in lib/gssapi/spnego/spnego_mech.c in the SPNEGO GSS-API functionality in MIT Kerberos 5 (aka krb5) 1.7 before 1.7.2 and 1.8 before 1.8.1 allows remote attackers to cause a denial of service (assertion failure and daemon crash) via an invalid packet that triggers incorrect preparation of an error token.
CVSS Details
- CVSS 3.1 Base Score: 5.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade krb5 | Jul 30, 2024 | Mar 25, 2010 |
| Freebsd | — | Upgrade krb5 | Dec 10, 2025 | Apr 19, 2010 |
| Suse | — | Upgrade krb5-plugin-preauth-pkinitUpgrade krb5-serverUpgrade krb5-plugin-kdb-ldapUpgrade krb5-clientUpgrade krb5-plugin-preauth-otpUpgrade krb5-develUpgrade krb5-32bitUpgrade krb5Upgrade krb5-docUpgrade krb5-plugin-preauth-spake | Feb 17, 2015 | Jun 28, 2013 |
| Ubuntu | — | Upgrade libgssapi-krb5-2Upgrade krb5-kdc | Nov 8, 2024 | Mar 25, 2010 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub