An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
- CVSS 3.0 Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade krb5-workstationUpgrade krb5-pkinitUpgrade krb5-debuginfoUpgrade krb5-serverUpgrade krb5-libsUpgrade krb5-server-ldapUpgrade krb5-develUpgrade libkadm5 | Apr 27, 2020 | Jul 26, 2018 |
| Amazon_linux | — | Upgrade krb5 | Sep 7, 2018 | Apr 10, 2018 |
| Centos_linux | — | Upgrade krb5-workstationUpgrade krb5-pkinitUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade krb5-debuginfoUpgrade krb5-develUpgrade libkadm5Upgrade krb5-libs | Aug 28, 2019 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp2 | — | Upgrade krb5-libsUpgrade krb5-serverUpgrade krb5-pkinitUpgrade libkadm5Upgrade krb5-develUpgrade krb5-server-ldapUpgrade krb5-workstation | Nov 6, 2018 | Jul 26, 2018 |
| Huawei Euleros 2_0_sp3 | — | Upgrade krb5-libsUpgrade libkadm5Upgrade krb5-develUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade krb5-pkinitUpgrade krb5-workstation | Nov 8, 2018 | Jul 26, 2018 |
| Oracle_linux | — | Upgrade krb5-pkinitUpgrade libkadm5Upgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-develUpgrade krb5-libsUpgrade krb5-server-ldap | Apr 19, 2018 | Aug 25, 2017 |
| Redhat_linux | — | Upgrade krb5-server-ldapUpgrade krb5-workstationUpgrade krb5-debuginfoUpgrade krb5-pkinitUpgrade krb5-develUpgrade krb5-serverUpgrade krb5-libsUpgrade libkadm5 | Apr 11, 2018 | Apr 10, 2018 |
| Suse | — | Upgrade krb5-serverUpgrade krb5-clientUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-32bitUpgrade krb5-docUpgrade krb5-plugin-preauth-otpUpgrade krb5Upgrade krb5-plugin-kdb-ldap | May 26, 2018 | Apr 10, 2018 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub