In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdal | Nov 8, 2019 | May 15, 2019 |
| Debian | — | Upgrade heimdal | Jun 4, 2019 | May 15, 2019 |
| Suse | — | Upgrade libheimdalUpgrade libheimdal-devel | Jul 2, 2019 | May 15, 2019 |
| Ubuntu | — | Upgrade libkrb5-26-heimdalUpgrade heimdal-clients (Ubuntu Pro)Upgrade heimdal-kdc (Ubuntu Pro)Upgrade heimdal-kdcUpgrade heimdal-servers-x (Ubuntu Pro)Upgrade heimdal-clientsUpgrade libkdc2-heimdalUpgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade heimdal-kcm (Ubuntu Pro)Upgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade heimdal-servers (Ubuntu Pro)Upgrade heimdal-clients-x (Ubuntu Pro)Upgrade heimdal-kcmUpgrade libgssapi3-heimdalUpgrade libkdc2-heimdal (Ubuntu Pro)Upgrade heimdal-servers | Oct 14, 2022 | May 15, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub