A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade softhsm-develUpgrade python3-ipalibUpgrade custodiaUpgrade ipa-clientUpgrade python3-custodiaUpgrade ipa-client-sambaUpgrade ipa-serverUpgrade softhsmUpgrade python3-jwcryptoUpgrade python3-yubicoUpgrade bind-dyndb-ldapUpgrade python3-ipaclientUpgrade ipa-python-compatUpgrade ipa-server-commonUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade ipa-client-commonUpgrade opendnssecUpgrade libkadm5Upgrade krb5-serverUpgrade python3-qrcode-coreUpgrade ipa-commonUpgrade python3-pyusbUpgrade python3-ipaserverUpgrade python3-qrcodeUpgrade ipa-server-trust-adUpgrade ipa-client-epnUpgrade ipa-server-dnsUpgrade python3-ipatestsUpgrade ipa-selinuxUpgrade krb5-pkinitUpgrade ipa-healthcheckUpgrade ipa-healthcheck-coreUpgrade slapi-nisUpgrade python3-kdcproxyUpgrade krb5-libsUpgrade krb5-devel | May 15, 2023 | Nov 11, 2020 |
| Amazon_linux | — | Upgrade samba | Dec 10, 2022 | Nov 11, 2020 |
| Amazon_linux_2023 | — | Upgrade samba-vfs-iouring-debuginfoUpgrade samba-winbind-clientsUpgrade samba-pidlUpgrade libnetapi-debuginfoUpgrade samba-commonUpgrade python3-samba-testUpgrade samba-develUpgrade libsmbclient-debuginfoUpgrade samba-testUpgrade samba-test-libs-debuginfoUpgrade samba-dc-libs-debuginfoUpgrade samba-test-libsUpgrade samba-common-libs-debuginfoUpgrade samba-winbindUpgrade samba-common-libsUpgrade samba-winbind-modulesUpgrade samba-winbind-modules-debuginfoUpgrade libnetapi-develUpgrade samba-debuginfoUpgrade samba-client-libs-debuginfoUpgrade samba-dc-libsUpgrade libwbclient-debuginfoUpgrade samba-libs-debuginfoUpgrade samba-vfs-iouringUpgrade samba-debugsourceUpgrade sambaUpgrade samba-winbind-debuginfoUpgrade python3-sambaUpgrade libwbclientUpgrade samba-winbind-krb5-locatorUpgrade samba-dcerpcUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-krb5-printingUpgrade samba-client-debuginfoUpgrade samba-usersharesUpgrade samba-common-toolsUpgrade samba-client-libsUpgrade python3-samba-develUpgrade samba-clientUpgrade samba-test-debuginfoUpgrade samba-libsUpgrade samba-ldb-ldap-modulesUpgrade samba-dcerpc-debuginfoUpgrade libwbclient-develUpgrade samba-winbind-clients-debuginfoUpgrade python3-samba-debuginfoUpgrade libnetapiUpgrade libsmbclientUpgrade samba-ldb-ldap-modules-debuginfoUpgrade samba-common-tools-debuginfoUpgrade libsmbclient-develUpgrade samba-krb5-printing-debuginfo | Feb 17, 2025 | Nov 10, 2020 |
| Centos_linux | — | Upgrade softhsmUpgrade softhsm-debugsourceUpgrade ipa-server-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-develUpgrade python3-kdcproxyUpgrade ipa-commonUpgrade ipa-debuginfoUpgrade softhsm-develUpgrade krb5-pkinitUpgrade python3-yubicoUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-python-compatUpgrade opendnssecUpgrade python3-jwcryptoUpgrade libkadm5-debuginfoUpgrade krb5-serverUpgrade krb5-libsUpgrade libkadm5Upgrade ipa-clientUpgrade opendnssec-debugsourceUpgrade krb5-workstationUpgrade python3-custodiaUpgrade ipa-client-debuginfoUpgrade python3-pyusbUpgrade ipa-client-epnUpgrade ipa-server-dnsUpgrade ipa-client-commonUpgrade slapi-nis-debugsourceUpgrade krb5-server-debuginfoUpgrade ipa-serverUpgrade opendnssec-debuginfoUpgrade python3-qrcode-coreUpgrade slapi-nisUpgrade python3-qrcodeUpgrade bind-dyndb-ldap-debugsourceUpgrade python3-ipaclientUpgrade krb5-debugsourceUpgrade ipa-selinuxUpgrade krb5-server-ldapUpgrade ipa-debugsourceUpgrade custodiaUpgrade softhsm-debuginfoUpgrade slapi-nis-debuginfoUpgrade python3-ipatestsUpgrade bind-dyndb-ldapUpgrade krb5-debuginfoUpgrade python3-ipalibUpgrade krb5-server-ldap-debuginfoUpgrade krb5-workstation-debuginfoUpgrade python3-ipaserverUpgrade krb5-pkinit-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-healthcheck-coreUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade ipa-healthcheckUpgrade ipa-server-trust-ad | May 15, 2023 | Nov 11, 2020 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Nov 11, 2020 |
| Msft | — | 2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5004307)2021-07 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5004285)2021-07 Cumulative Update for Microsoft Windows Server 2012 (KB5004302)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5001392)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB4586808)2021-04 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5001330)2020-12 Security Only Quality Update for Windows 7 for x86-based Systems (KB4592503)2021-04 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5001393)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5004307)2021-07 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5004237)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5001383)2020-11 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB4586781)2021-07 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5004237)2021-04 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5001392)2020-11 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB4586781)2020-11 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB4586823)2021-04 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5001330)2021-07 Security Only Quality Update for Windows 7 for x64-based Systems (KB5004307)2021-07 Cumulative Update for Microsoft Windows Server 2012 R2 (KB5004285)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5004302)2021-07 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5004285)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5004302)2021-04 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5001332)2021-07 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5004307)2021-07 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5004299)2020-12 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB4592504)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB4592503)2020-11 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB4586786)2020-12 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows 7 for x86-based Systems (KB5004307)2021-04 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB5001337)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB4586808)2021-07 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5004299)2020-12 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB4592504)2021-07 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB5004238)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5001392)2021-04 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5001393)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB4592503)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5001383)2021-04 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5001332)2020-12 Security Only Quality Update for Windows 7 for x64-based Systems (KB4592503)2020-11 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB4586823)2020-11 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4586786)2021-07 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5004244) | Nov 10, 2020 | Nov 10, 2020 |
| Oracle Solaris | — | Upgrade service/network/samba to version 4.13.14-11.4.42.0.1.113.0 on Solaris 11.4Upgrade library/samba/libsmbclient to version 4.13.8-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Nov 11, 2020 |
| Oracle_linux | — | Upgrade krb5-serverUpgrade python3-ipalibUpgrade slapi-nisUpgrade custodiaUpgrade python3-yubicoUpgrade krb5-workstationUpgrade ipa-serverUpgrade python3-ipatestsUpgrade ipa-clientUpgrade python3-pyusbUpgrade ipa-server-trust-adUpgrade ipa-server-commonUpgrade python3-kdcproxyUpgrade ipa-healthcheckUpgrade ipa-commonUpgrade ipa-client-commonUpgrade ipa-selinuxUpgrade softhsm-develUpgrade krb5-libsUpgrade ipa-server-dnsUpgrade ipa-client-epnUpgrade krb5-develUpgrade ipa-client-sambaUpgrade ipa-python-compatUpgrade bind-dyndb-ldapUpgrade python3-ipaclientUpgrade python3-jwcryptoUpgrade opendnssecUpgrade python3-custodiaUpgrade python3-qrcodeUpgrade libkadm5Upgrade ipa-healthcheck-coreUpgrade python3-ipaserverUpgrade python3-qrcode-coreUpgrade softhsmUpgrade krb5-server-ldapUpgrade krb5-pkinit | May 17, 2023 | Nov 10, 2020 |
| Redhat_linux | — | Upgrade bind-dyndb-ldap-debugsourceUpgrade krb5-workstation-debuginfoUpgrade softhsm-debuginfoUpgrade bind-dyndb-ldapUpgrade ipa-client-sambaUpgrade krb5-server-ldapUpgrade python3-kdcproxyUpgrade softhsm-debugsourceUpgrade opendnssec-debugsourceUpgrade krb5-debugsourceUpgrade ipa-healthcheckUpgrade krb5-devel-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-libsUpgrade ipa-server-dnsUpgrade ipa-server-commonUpgrade ipa-debugsourceUpgrade custodiaUpgrade python3-qrcodeUpgrade python3-pyusbUpgrade python3-ipaclientUpgrade ipa-healthcheck-coreUpgrade ipa-server-trust-ad-debuginfoUpgrade ipa-selinuxUpgrade ipa-client-epnUpgrade softhsm-develUpgrade ipa-debuginfoUpgrade python3-ipalibUpgrade krb5-libs-debuginfoUpgrade ipa-serverUpgrade python3-jwcryptoUpgrade ipa-server-debuginfoUpgrade bind-dyndb-ldap-debuginfoUpgrade krb5-serverUpgrade ipa-python-compatUpgrade opendnssecUpgrade krb5-develUpgrade libkadm5Upgrade ipa-clientUpgrade softhsmUpgrade python3-ipaserverUpgrade krb5-pkinitUpgrade python3-qrcode-coreUpgrade ipa-server-trust-adUpgrade python3-ipatestsUpgrade opendnssec-debuginfoUpgrade krb5-server-debuginfoUpgrade ipa-client-debuginfoUpgrade python3-custodiaNo solution existsUpgrade krb5-debuginfoUpgrade libkadm5-debuginfoUpgrade slapi-nis-debugsourceUpgrade ipa-client-commonUpgrade slapi-nis-debuginfoUpgrade ipa-commonUpgrade slapi-nisUpgrade krb5-workstationUpgrade python3-yubico | May 15, 2023 | Nov 11, 2020 |
| Rocky_linux | — | Upgrade opendnssec-debugsourceUpgrade softhsm-develUpgrade opendnssecUpgrade softhsm-debugsourceUpgrade softhsmUpgrade slapi-nisUpgrade softhsm-debuginfoUpgrade slapi-nis-debugsourceUpgrade slapi-nis-debuginfoUpgrade opendnssec-debuginfo | Aug 15, 2024 | Nov 11, 2020 |
| Suse | — | Upgrade libsamba-errors-develUpgrade libsamba-policy-python3-develUpgrade samba-winbind-libs-32bitUpgrade samba-gpupdateUpgrade samba-client-libs-32bitUpgrade libsamba-policy-develUpgrade libsamba-errors0Upgrade samba-develUpgrade samba-client-32bitUpgrade samba-clientUpgrade samba-winbind-libsUpgrade samba-dsdb-modulesUpgrade samba-cephUpgrade samba-libs-python3Upgrade samba-winbindUpgrade sambaUpgrade samba-ad-dc-libsUpgrade libsamba-policy0-python3Upgrade samba-libs-32bitUpgrade samba-libsUpgrade samba-client-libsUpgrade samba-ldb-ldapUpgrade samba-python3 | Aug 9, 2024 | Nov 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub