In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdal | Nov 8, 2019 | May 15, 2019 |
| Debian | — | Upgrade heimdal | Jun 4, 2019 | May 15, 2019 |
| Suse | — | Upgrade libheimdal-develUpgrade libheimdal | Jul 2, 2019 | May 15, 2019 |
| Ubuntu | — | Upgrade heimdal-servers-x (Ubuntu Pro)Upgrade libkdc2-heimdalUpgrade heimdal-clients (Ubuntu Pro)Upgrade heimdal-clientsUpgrade heimdal-kdcUpgrade heimdal-kdc (Ubuntu Pro)Upgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdalUpgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade heimdal-serversUpgrade heimdal-kcmUpgrade heimdal-kcm (Ubuntu Pro)Upgrade heimdal-servers (Ubuntu Pro)Upgrade libgssapi3-heimdalUpgrade libkdc2-heimdal (Ubuntu Pro)Upgrade heimdal-clients-x (Ubuntu Pro) | Oct 14, 2022 | May 15, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub