A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade softhsm-develUpgrade ipa-commonUpgrade bind-dyndb-ldapUpgrade python3-qrcode-coreUpgrade python3-pyusbUpgrade krb5-workstationUpgrade opendnssecUpgrade libkadm5Upgrade softhsmUpgrade ipa-clientUpgrade python3-ipalibUpgrade ipa-serverUpgrade python3-yubicoUpgrade python3-ipaclientUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade custodiaUpgrade python3-jwcryptoUpgrade ipa-python-compatUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade ipa-client-commonUpgrade python3-ipaserverUpgrade python3-custodiaUpgrade slapi-nisUpgrade ipa-client-epnUpgrade ipa-server-trust-adUpgrade krb5-pkinitUpgrade ipa-healthcheckUpgrade ipa-server-dnsUpgrade python3-qrcodeUpgrade python3-kdcproxyUpgrade krb5-develUpgrade ipa-healthcheck-coreUpgrade krb5-libsUpgrade python3-ipatestsUpgrade ipa-selinux | May 15, 2023 | Nov 11, 2020 |
| Amazon_linux | — | Upgrade samba | Dec 10, 2022 | Nov 11, 2020 |
| Amazon_linux_2023 | — | Upgrade samba-test-libsUpgrade samba-testUpgrade samba-vfs-iouringUpgrade samba-common-libsUpgrade libwbclient-debuginfoUpgrade samba-debugsourceUpgrade python3-samba-testUpgrade samba-winbind-modulesUpgrade samba-client-libs-debuginfoUpgrade samba-debuginfoUpgrade samba-pidlUpgrade samba-winbindUpgrade libnetapi-develUpgrade samba-develUpgrade samba-dc-libs-debuginfoUpgrade samba-libs-debuginfoUpgrade samba-dc-libsUpgrade libnetapi-debuginfoUpgrade samba-winbind-modules-debuginfoUpgrade samba-vfs-iouring-debuginfoUpgrade samba-commonUpgrade sambaUpgrade samba-common-libs-debuginfoUpgrade samba-test-libs-debuginfoUpgrade libsmbclient-debuginfoUpgrade samba-winbind-clientsUpgrade samba-ldb-ldap-modules-debuginfoUpgrade samba-client-libsUpgrade python3-samba-develUpgrade samba-common-tools-debuginfoUpgrade samba-ldb-ldap-modulesUpgrade libnetapiUpgrade libsmbclientUpgrade samba-winbind-debuginfoUpgrade samba-common-toolsUpgrade samba-krb5-printingUpgrade libsmbclient-develUpgrade samba-libsUpgrade samba-test-debuginfoUpgrade python3-sambaUpgrade samba-dcerpcUpgrade python3-samba-debuginfoUpgrade samba-dcerpc-debuginfoUpgrade libwbclient-develUpgrade samba-winbind-clients-debuginfoUpgrade samba-client-debuginfoUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-usersharesUpgrade samba-winbind-krb5-locatorUpgrade samba-krb5-printing-debuginfoUpgrade libwbclientUpgrade samba-client | Feb 17, 2025 | Nov 10, 2020 |
| Centos_linux | — | Upgrade ipa-server-commonUpgrade ipa-server-trust-adUpgrade ipa-selinuxUpgrade krb5-debugsourceUpgrade python3-ipalibUpgrade krb5-debuginfoUpgrade python3-ipaclientUpgrade bind-dyndb-ldap-debugsourceUpgrade bind-dyndb-ldapUpgrade python3-ipatestsUpgrade slapi-nis-debuginfoUpgrade softhsm-debuginfoUpgrade krb5-server-ldapUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-ipaserverUpgrade krb5-pkinit-debuginfoUpgrade ipa-healthcheckUpgrade ipa-healthcheck-coreUpgrade krb5-workstation-debuginfoUpgrade ipa-client-sambaUpgrade krb5-server-ldap-debuginfoUpgrade ipa-debugsourceUpgrade custodiaUpgrade python3-qrcodeUpgrade python3-custodiaUpgrade opendnssec-debugsourceUpgrade krb5-workstationUpgrade krb5-serverUpgrade ipa-serverUpgrade libkadm5-debuginfoUpgrade libkadm5Upgrade ipa-clientUpgrade krb5-libsUpgrade ipa-server-dnsUpgrade krb5-pkinitUpgrade ipa-server-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade python3-yubicoUpgrade python3-kdcproxyUpgrade krb5-libs-debuginfoUpgrade softhsmUpgrade softhsm-develUpgrade ipa-python-compatUpgrade softhsm-debugsourceUpgrade slapi-nis-debugsourceUpgrade python3-qrcode-coreUpgrade opendnssec-debuginfoUpgrade opendnssecUpgrade ipa-commonUpgrade slapi-nisUpgrade ipa-client-debuginfoUpgrade python3-pyusbUpgrade ipa-client-epnUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade krb5-develUpgrade python3-jwcryptoUpgrade krb5-server-debuginfo | May 15, 2023 | Nov 11, 2020 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Nov 11, 2020 |
| Msft | — | 2021-04 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB5001337)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB4586808)2021-07 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB5004238)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5004307)2021-04 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5001393)2021-04 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5001332)2021-07 Security Only Quality Update for Windows 7 for x86-based Systems (KB5004307)2020-12 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB4592503)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5001392)2020-11 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4586786)2021-07 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5004299)2020-11 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB4586786)2020-12 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB4592504)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5004302)2021-04 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5001332)2020-11 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB4586823)2021-07 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5004299)2020-12 Security Only Quality Update for Windows 7 for x64-based Systems (KB4592503)2020-12 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB4592504)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB4592503)2021-07 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5004244)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5001383)2020-11 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB4586781)2021-04 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5001393)2021-07 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5004237)2021-07 Cumulative Update for Microsoft Windows Server 2012 (KB5004302)2021-07 Security Only Quality Update for Windows 7 for x64-based Systems (KB5004307)2020-12 Security Only Quality Update for Windows 7 for x86-based Systems (KB4592503)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5001383)2021-07 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5004285)2021-04 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5001392)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5001392)2020-11 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB4586781)2021-07 Cumulative Update for Microsoft Windows Server 2012 R2 (KB5004285)2021-04 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5001330)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5004307)2021-04 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5001330)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB4586808)2021-07 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5004285)2021-07 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5004237)2020-11 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB4586823)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5004302)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5004307) | Nov 10, 2020 | Nov 10, 2020 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.13.14-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/samba/libsmbclient to version 4.13.8-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Nov 11, 2020 |
| Oracle_linux | — | Upgrade python3-ipalibUpgrade ipa-healthcheckUpgrade ipa-commonUpgrade softhsm-develUpgrade ipa-server-commonUpgrade python3-kdcproxyUpgrade slapi-nisUpgrade python3-yubicoUpgrade krb5-workstationUpgrade ipa-serverUpgrade krb5-serverUpgrade custodiaUpgrade ipa-server-trust-adUpgrade python3-ipatestsUpgrade python3-pyusbUpgrade ipa-clientUpgrade ipa-client-commonUpgrade ipa-selinuxUpgrade python3-qrcodeUpgrade softhsmUpgrade python3-ipaclientUpgrade krb5-develUpgrade ipa-python-compatUpgrade ipa-client-sambaUpgrade bind-dyndb-ldapUpgrade python3-jwcryptoUpgrade krb5-pkinitUpgrade opendnssecUpgrade libkadm5Upgrade python3-qrcode-coreUpgrade python3-ipaserverUpgrade ipa-healthcheck-coreUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade python3-custodiaUpgrade krb5-libsUpgrade krb5-server-ldap | May 17, 2023 | Nov 10, 2020 |
| Redhat_linux | — | Upgrade ipa-client-sambaUpgrade krb5-pkinit-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade ipa-selinuxUpgrade python3-kdcproxyUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade ipa-client-epnUpgrade krb5-debugsourceUpgrade softhsm-debugsourceUpgrade python3-qrcodeUpgrade bind-dyndb-ldapUpgrade krb5-workstation-debuginfoUpgrade ipa-server-commonUpgrade ipa-healthcheckUpgrade ipa-healthcheck-coreUpgrade softhsm-debuginfoUpgrade custodiaUpgrade ipa-server-trust-ad-debuginfoUpgrade python3-pyusbUpgrade opendnssec-debugsourceUpgrade krb5-devel-debuginfoUpgrade ipa-server-dnsUpgrade krb5-server-ldap-debuginfoUpgrade python3-ipaclientUpgrade ipa-debugsourceUpgrade python3-jwcryptoUpgrade python3-qrcode-coreUpgrade python3-ipalibUpgrade softhsm-develUpgrade bind-dyndb-ldap-debuginfoUpgrade krb5-pkinitUpgrade slapi-nis-debugsourceUpgrade krb5-develUpgrade krb5-workstationNo solution existsUpgrade ipa-serverUpgrade softhsmUpgrade ipa-clientUpgrade opendnssecUpgrade ipa-server-trust-adUpgrade slapi-nisUpgrade python3-custodiaUpgrade ipa-python-compatUpgrade libkadm5-debuginfoUpgrade ipa-server-debuginfoUpgrade libkadm5Upgrade ipa-client-commonUpgrade python3-yubicoUpgrade ipa-debuginfoUpgrade krb5-debuginfoUpgrade ipa-commonUpgrade krb5-server-debuginfoUpgrade slapi-nis-debuginfoUpgrade krb5-serverUpgrade python3-ipatestsUpgrade krb5-libs-debuginfoUpgrade ipa-client-debuginfoUpgrade python3-ipaserverUpgrade opendnssec-debuginfo | May 15, 2023 | Nov 11, 2020 |
| Rocky_linux | — | Upgrade slapi-nis-debuginfoUpgrade softhsm-debuginfoUpgrade opendnssec-debuginfoUpgrade slapi-nis-debugsourceUpgrade slapi-nisUpgrade softhsmUpgrade softhsm-develUpgrade opendnssec-debugsourceUpgrade softhsm-debugsourceUpgrade opendnssec | Aug 15, 2024 | Nov 11, 2020 |
| Suse | — | Upgrade samba-client-libs-32bitUpgrade samba-clientUpgrade samba-develUpgrade libsamba-errors-develUpgrade libsamba-policy-python3-develUpgrade libsamba-errors0Upgrade libsamba-policy-develUpgrade samba-gpupdateUpgrade samba-winbind-libs-32bitUpgrade samba-client-32bitUpgrade samba-cephUpgrade samba-client-libsUpgrade samba-ad-dc-libsUpgrade samba-dsdb-modulesUpgrade samba-libs-python3Upgrade samba-winbindUpgrade samba-ldb-ldapUpgrade libsamba-policy0-python3Upgrade samba-python3Upgrade samba-winbind-libsUpgrade samba-libs-32bitUpgrade samba-libsUpgrade samba | Aug 9, 2024 | Nov 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub