A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-healthcheck-coreUpgrade krb5-libsUpgrade python3-qrcodeUpgrade krb5-pkinitUpgrade python3-ipatestsUpgrade ipa-server-trust-adUpgrade krb5-develUpgrade python3-kdcproxyUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-healthcheckUpgrade ipa-selinuxUpgrade slapi-nisUpgrade ipa-commonUpgrade ipa-client-commonUpgrade libkadm5Upgrade ipa-server-commonUpgrade python3-qrcode-coreUpgrade bind-dyndb-ldapUpgrade ipa-client-sambaUpgrade krb5-server-ldapUpgrade ipa-clientUpgrade python3-custodiaUpgrade python3-ipalibUpgrade ipa-serverUpgrade softhsm-develUpgrade python3-pyusbUpgrade python3-ipaserverUpgrade python3-ipaclientUpgrade krb5-serverUpgrade python3-jwcryptoUpgrade opendnssecUpgrade softhsmUpgrade custodiaUpgrade krb5-workstationUpgrade python3-yubicoUpgrade ipa-python-compat | May 15, 2023 | Nov 11, 2020 |
| Amazon_linux | — | Upgrade samba | Dec 10, 2022 | Nov 11, 2020 |
| Amazon_linux_2023 | — | Upgrade samba-winbind-clients-debuginfoUpgrade libwbclientUpgrade samba-dcerpc-debuginfoUpgrade libwbclient-develUpgrade python3-samba-debuginfoUpgrade samba-test-debuginfoUpgrade samba-ldb-ldap-modulesUpgrade samba-clientUpgrade libsmbclientUpgrade libsmbclient-develUpgrade libnetapiUpgrade python3-sambaUpgrade samba-krb5-printingUpgrade samba-client-debuginfoUpgrade samba-dcerpcUpgrade samba-common-tools-debuginfoUpgrade samba-libsUpgrade samba-krb5-printing-debuginfoUpgrade samba-winbind-krb5-locatorUpgrade samba-winbind-krb5-locator-debuginfoUpgrade python3-samba-develUpgrade samba-ldb-ldap-modules-debuginfoUpgrade samba-client-libsUpgrade samba-winbind-debuginfoUpgrade samba-common-toolsUpgrade samba-usersharesUpgrade samba-dc-libs-debuginfoUpgrade samba-libs-debuginfoUpgrade samba-common-libsUpgrade samba-debugsourceUpgrade libwbclient-debuginfoUpgrade samba-vfs-iouring-debuginfoUpgrade sambaUpgrade samba-common-libs-debuginfoUpgrade samba-winbind-modulesUpgrade samba-winbindUpgrade samba-winbind-clientsUpgrade samba-client-libs-debuginfoUpgrade libnetapi-debuginfoUpgrade samba-dc-libsUpgrade samba-develUpgrade samba-debuginfoUpgrade python3-samba-testUpgrade samba-pidlUpgrade samba-testUpgrade samba-test-libs-debuginfoUpgrade libnetapi-develUpgrade samba-commonUpgrade libsmbclient-debuginfoUpgrade samba-winbind-modules-debuginfoUpgrade samba-vfs-iouringUpgrade samba-test-libs | Feb 17, 2025 | Nov 10, 2020 |
| Centos_linux | — | Upgrade bind-dyndb-ldap-debugsourceUpgrade bind-dyndb-ldapUpgrade python3-ipaclientUpgrade python3-ipatestsUpgrade slapi-nis-debuginfoUpgrade softhsm-debuginfoUpgrade krb5-debuginfoUpgrade python3-ipalibUpgrade krb5-debugsourceUpgrade krb5-pkinit-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-ipaserverUpgrade ipa-healthcheckUpgrade ipa-selinuxUpgrade ipa-healthcheck-coreUpgrade ipa-server-trust-adUpgrade ipa-server-commonUpgrade ipa-client-sambaUpgrade python3-qrcodeUpgrade krb5-server-ldapUpgrade krb5-server-ldap-debuginfoUpgrade ipa-debugsourceUpgrade custodiaUpgrade krb5-workstation-debuginfoUpgrade ipa-serverUpgrade ipa-server-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade krb5-workstationUpgrade ipa-python-compatUpgrade ipa-commonUpgrade python3-jwcryptoUpgrade krb5-serverUpgrade krb5-server-debuginfoUpgrade krb5-develUpgrade libkadm5-debuginfoUpgrade libkadm5Upgrade krb5-libsUpgrade ipa-server-dnsUpgrade ipa-clientUpgrade ipa-client-epnUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade krb5-libs-debuginfoUpgrade softhsm-debugsourceUpgrade softhsmUpgrade softhsm-develUpgrade python3-custodiaUpgrade python3-yubicoUpgrade slapi-nis-debugsourceUpgrade slapi-nisUpgrade python3-qrcode-coreUpgrade opendnssec-debuginfoUpgrade opendnssecUpgrade python3-kdcproxyUpgrade krb5-pkinitUpgrade opendnssec-debugsourceUpgrade python3-pyusbUpgrade ipa-client-debuginfo | May 15, 2023 | Nov 11, 2020 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Nov 11, 2020 |
| Msft | — | 2020-11 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4586786)2021-04 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5001332)2020-12 Security Only Quality Update for Windows 7 for x64-based Systems (KB4592503)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5001383)2020-11 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB4586786)2021-07 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5004244)2020-11 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB4586823)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5004299)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB4586808)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB4592503)2021-04 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5001393)2021-07 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB5004238)2020-12 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5004307)2021-04 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5001332)2021-07 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5004299)2021-04 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB5001337)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5004302)2020-12 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB4592504)2021-07 Security Only Quality Update for Windows 7 for x86-based Systems (KB5004307)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5001392)2020-12 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB4592504)2020-11 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB4586781)2021-07 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5004237)2021-07 Security Only Quality Update for Windows 7 for x64-based Systems (KB5004307)2021-04 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5001392)2020-11 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB4586781)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5001383)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5001392)2021-07 Cumulative Update for Microsoft Windows Server 2012 R2 (KB5004285)2020-12 Security Only Quality Update for Windows 7 for x86-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5004285)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5004307)2021-04 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5001330)2020-11 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB4586823)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5004307)2021-07 Cumulative Update for Microsoft Windows Server 2012 (KB5004302)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5004302)2021-07 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5004237)2021-04 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5001330)2021-07 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5004285)2021-04 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5001393)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB4586808) | Nov 10, 2020 | Nov 10, 2020 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.13.14-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/samba/libsmbclient to version 4.13.8-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Nov 11, 2020 |
| Oracle_linux | — | Upgrade python3-pyusbUpgrade krb5-workstationUpgrade ipa-server-trust-adUpgrade ipa-selinuxUpgrade python3-yubicoUpgrade ipa-clientUpgrade ipa-client-commonUpgrade ipa-server-commonUpgrade softhsm-develUpgrade krb5-serverUpgrade ipa-commonUpgrade python3-ipatestsUpgrade ipa-healthcheckUpgrade python3-kdcproxyUpgrade slapi-nisUpgrade python3-ipalibUpgrade custodiaUpgrade ipa-serverUpgrade python3-qrcodeUpgrade python3-ipaclientUpgrade krb5-develUpgrade ipa-python-compatUpgrade ipa-client-sambaUpgrade krb5-libsUpgrade python3-custodiaUpgrade python3-qrcode-coreUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade python3-ipaserverUpgrade opendnssecUpgrade libkadm5Upgrade python3-jwcryptoUpgrade krb5-pkinitUpgrade ipa-healthcheck-coreUpgrade krb5-server-ldapUpgrade bind-dyndb-ldapUpgrade softhsm | May 17, 2023 | Nov 10, 2020 |
| Redhat_linux | — | Upgrade python3-ipalibUpgrade ipa-python-compatUpgrade softhsm-develUpgrade slapi-nis-debuginfoUpgrade python3-yubicoUpgrade ipa-commonUpgrade ipa-server-trust-adUpgrade opendnssecUpgrade slapi-nisUpgrade krb5-pkinitUpgrade bind-dyndb-ldap-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-debuginfoUpgrade ipa-server-debuginfoUpgrade softhsmUpgrade libkadm5Upgrade krb5-libs-debuginfoUpgrade python3-ipaserverUpgrade python3-ipatestsUpgrade python3-jwcryptoUpgrade krb5-server-debuginfoUpgrade krb5-develUpgrade ipa-client-debuginfoUpgrade opendnssec-debuginfoUpgrade ipa-clientUpgrade ipa-client-commonUpgrade krb5-serverUpgrade python3-qrcode-coreUpgrade libkadm5-debuginfoUpgrade krb5-debuginfoNo solution existsUpgrade python3-custodiaUpgrade ipa-serverUpgrade krb5-workstationUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade python3-pyusbUpgrade python3-ipaclientUpgrade ipa-healthcheck-coreUpgrade krb5-devel-debuginfoUpgrade krb5-libsUpgrade krb5-workstation-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade bind-dyndb-ldapUpgrade ipa-debugsourceUpgrade custodiaUpgrade python3-qrcodeUpgrade krb5-debugsourceUpgrade ipa-healthcheckUpgrade opendnssec-debugsourceUpgrade krb5-pkinit-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade krb5-server-ldapUpgrade python3-kdcproxyUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade ipa-selinuxUpgrade softhsm-debugsourceUpgrade softhsm-debuginfoUpgrade krb5-server-ldap-debuginfo | May 15, 2023 | Nov 11, 2020 |
| Rocky_linux | — | Upgrade slapi-nis-debuginfoUpgrade slapi-nis-debugsourceUpgrade softhsm-debuginfoUpgrade slapi-nisUpgrade opendnssec-debuginfoUpgrade softhsmUpgrade opendnssec-debugsourceUpgrade softhsm-debugsourceUpgrade softhsm-develUpgrade opendnssec | Aug 15, 2024 | Nov 11, 2020 |
| Suse | — | Upgrade samba-gpupdateUpgrade samba-winbind-libs-32bitUpgrade samba-client-libs-32bitUpgrade libsamba-policy-python3-develUpgrade libsamba-errors0Upgrade samba-develUpgrade samba-client-32bitUpgrade libsamba-errors-develUpgrade samba-clientUpgrade libsamba-policy-develUpgrade samba-libs-32bitUpgrade samba-libsUpgrade samba-dsdb-modulesUpgrade libsamba-policy0-python3Upgrade samba-client-libsUpgrade samba-ad-dc-libsUpgrade samba-ldb-ldapUpgrade samba-python3Upgrade samba-winbindUpgrade samba-libs-python3Upgrade sambaUpgrade samba-cephUpgrade samba-winbind-libs | Aug 9, 2024 | Nov 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub