In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
CVSS Details
- CVSS 3.1 Base Score: 7.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade heimdal | Nov 8, 2019 | May 15, 2019 |
| Debian | — | Upgrade heimdal | Jun 4, 2019 | May 15, 2019 |
| Suse | — | Upgrade libheimdalUpgrade libheimdal-devel | Jul 2, 2019 | May 15, 2019 |
| Ubuntu | — | Upgrade heimdal-serversUpgrade libgssapi3-heimdalUpgrade heimdal-kcmUpgrade heimdal-kcm (Ubuntu Pro)Upgrade heimdal-servers (Ubuntu Pro)Upgrade heimdal-clients-x (Ubuntu Pro)Upgrade libkdc2-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade heimdal-kdc (Ubuntu Pro)Upgrade heimdal-servers-x (Ubuntu Pro)Upgrade heimdal-clients (Ubuntu Pro)Upgrade libkdc2-heimdalUpgrade heimdal-clientsUpgrade heimdal-kdcUpgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdal | Oct 14, 2022 | May 15, 2019 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub