A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-server-trust-adUpgrade slapi-nisUpgrade ipa-client-epnUpgrade ipa-selinuxUpgrade ipa-healthcheckUpgrade ipa-healthcheck-coreUpgrade krb5-libsUpgrade python3-qrcodeUpgrade ipa-server-dnsUpgrade krb5-pkinitUpgrade python3-ipatestsUpgrade krb5-develUpgrade python3-kdcproxyUpgrade python3-yubicoUpgrade ipa-python-compatUpgrade softhsm-develUpgrade krb5-server-ldapUpgrade libkadm5Upgrade python3-jwcryptoUpgrade krb5-workstationUpgrade krb5-serverUpgrade ipa-clientUpgrade bind-dyndb-ldapUpgrade ipa-client-sambaUpgrade python3-custodiaUpgrade softhsmUpgrade python3-ipaclientUpgrade python3-ipalibUpgrade ipa-serverUpgrade python3-qrcode-coreUpgrade opendnssecUpgrade python3-ipaserverUpgrade ipa-server-commonUpgrade custodiaUpgrade ipa-client-commonUpgrade ipa-commonUpgrade python3-pyusb | May 15, 2023 | Nov 11, 2020 |
| Amazon_linux | — | Upgrade samba | Dec 10, 2022 | Nov 11, 2020 |
| Amazon_linux_2023 | — | Upgrade samba-winbind-modulesUpgrade samba-client-libs-debuginfoUpgrade samba-winbindUpgrade samba-libs-debuginfoUpgrade samba-dc-libsUpgrade samba-develUpgrade libnetapi-debuginfoUpgrade samba-dc-libs-debuginfoUpgrade samba-test-libsUpgrade samba-vfs-iouringUpgrade samba-test-libs-debuginfoUpgrade libsmbclient-debuginfoUpgrade samba-commonUpgrade samba-winbind-modules-debuginfoUpgrade libnetapi-develUpgrade samba-pidlUpgrade samba-debuginfoUpgrade samba-common-libsUpgrade samba-winbind-clientsUpgrade samba-common-libs-debuginfoUpgrade python3-samba-testUpgrade libwbclient-debuginfoUpgrade samba-vfs-iouring-debuginfoUpgrade samba-debugsourceUpgrade sambaUpgrade samba-testUpgrade samba-ldb-ldap-modules-debuginfoUpgrade samba-clientUpgrade samba-common-toolsUpgrade samba-client-libsUpgrade samba-krb5-printing-debuginfoUpgrade samba-winbind-debuginfoUpgrade libsmbclientUpgrade libnetapiUpgrade libsmbclient-develUpgrade samba-common-tools-debuginfoUpgrade python3-sambaUpgrade python3-samba-develUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-usersharesUpgrade samba-dcerpcUpgrade samba-client-debuginfoUpgrade samba-test-debuginfoUpgrade samba-libsUpgrade samba-ldb-ldap-modulesUpgrade samba-krb5-printingUpgrade samba-winbind-clients-debuginfoUpgrade samba-dcerpc-debuginfoUpgrade python3-samba-debuginfoUpgrade libwbclient-develUpgrade samba-winbind-krb5-locatorUpgrade libwbclient | Feb 17, 2025 | Nov 10, 2020 |
| Centos_linux | — | Upgrade ipa-server-trust-adUpgrade python3-ipalibUpgrade ipa-server-commonUpgrade krb5-debuginfoUpgrade krb5-debugsourceUpgrade python3-ipaclientUpgrade ipa-client-sambaUpgrade ipa-debugsourceUpgrade krb5-server-ldapUpgrade bind-dyndb-ldap-debugsourceUpgrade bind-dyndb-ldapUpgrade python3-ipatestsUpgrade slapi-nis-debuginfoUpgrade softhsm-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade python3-ipaserverUpgrade python3-qrcodeUpgrade ipa-server-trust-ad-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade custodiaUpgrade ipa-selinuxUpgrade krb5-workstation-debuginfoUpgrade ipa-healthcheckUpgrade ipa-healthcheck-coreUpgrade softhsm-debugsourceUpgrade ipa-client-commonUpgrade python3-jwcryptoUpgrade opendnssec-debuginfoUpgrade ipa-serverUpgrade ipa-debuginfoUpgrade ipa-client-epnUpgrade opendnssecUpgrade ipa-client-debuginfoUpgrade opendnssec-debugsourceUpgrade python3-pyusbUpgrade krb5-develUpgrade krb5-workstationUpgrade libkadm5-debuginfoUpgrade ipa-clientUpgrade krb5-libsUpgrade ipa-server-dnsUpgrade libkadm5Upgrade softhsm-develUpgrade ipa-commonUpgrade ipa-python-compatUpgrade python3-yubicoUpgrade python3-kdcproxyUpgrade ipa-server-debuginfoUpgrade python3-custodiaUpgrade bind-dyndb-ldap-debuginfoUpgrade krb5-libs-debuginfoUpgrade softhsmUpgrade krb5-pkinitUpgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade slapi-nis-debugsourceUpgrade slapi-nisUpgrade python3-qrcode-core | May 15, 2023 | Nov 11, 2020 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Nov 11, 2020 |
| Msft | — | 2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5001383)2021-07 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5004285)2021-07 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5004237)2021-07 Security Only Quality Update for Windows 7 for x64-based Systems (KB5004307)2020-11 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB4586823)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5004307)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5001392)2020-12 Security Only Quality Update for Windows 7 for x86-based Systems (KB4592503)2021-07 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5004237)2021-07 Cumulative Update for Microsoft Windows Server 2012 R2 (KB5004285)2021-04 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5001330)2021-07 Cumulative Update for Microsoft Windows Server 2012 (KB5004302)2020-11 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB4586781)2021-07 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5004285)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5004307)2020-11 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB4586781)2021-04 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5001392)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5004302)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB4586808)2021-04 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5001330)2021-04 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5001393)2021-07 Security Only Quality Update for Windows 7 for x86-based Systems (KB5004307)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB4592503)2020-11 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB4586786)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5001383)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB4586808)2021-04 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB5001337)2021-04 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5001393)2020-12 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5004302)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5004299)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5001392)2021-07 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5004307)2021-07 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB5004238)2021-04 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5001332)2020-12 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB4592504)2020-11 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB4586823)2020-11 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4586786)2021-07 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5004244)2021-04 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5001332)2020-12 Security Only Quality Update for Windows 7 for x64-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5004299)2020-12 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB4592504) | Nov 10, 2020 | Nov 10, 2020 |
| Oracle Solaris | — | Upgrade library/samba/libsmbclient to version 4.13.8-11.4.42.0.1.113.0 on Solaris 11.4Upgrade service/network/samba to version 4.13.14-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Nov 11, 2020 |
| Oracle_linux | — | Upgrade python3-qrcode-coreUpgrade python3-ipaserverUpgrade ipa-healthcheck-coreUpgrade opendnssecUpgrade ipa-client-sambaUpgrade ipa-client-epnUpgrade krb5-develUpgrade ipa-server-dnsUpgrade python3-custodiaUpgrade python3-qrcodeUpgrade python3-ipaclientUpgrade libkadm5Upgrade python3-jwcryptoUpgrade krb5-pkinitUpgrade ipa-python-compatUpgrade softhsmUpgrade krb5-libsUpgrade bind-dyndb-ldapUpgrade krb5-server-ldapUpgrade ipa-serverUpgrade softhsm-develUpgrade python3-ipalibUpgrade custodiaUpgrade ipa-commonUpgrade ipa-client-commonUpgrade ipa-healthcheckUpgrade ipa-clientUpgrade python3-kdcproxyUpgrade ipa-server-commonUpgrade python3-ipatestsUpgrade python3-pyusbUpgrade krb5-workstationUpgrade ipa-server-trust-adUpgrade python3-yubicoUpgrade ipa-selinuxUpgrade slapi-nisUpgrade krb5-server | May 17, 2023 | Nov 10, 2020 |
| Redhat_linux | — | Upgrade python3-ipaclientUpgrade ipa-healthcheckUpgrade softhsm-debuginfoUpgrade opendnssec-debugsourceUpgrade ipa-debugsourceUpgrade bind-dyndb-ldapUpgrade softhsm-debugsourceUpgrade ipa-server-commonUpgrade krb5-libsUpgrade krb5-debugsourceUpgrade python3-qrcodeUpgrade krb5-server-ldap-debuginfoUpgrade ipa-client-epnUpgrade krb5-devel-debuginfoUpgrade ipa-healthcheck-coreUpgrade krb5-workstation-debuginfoUpgrade custodiaUpgrade python3-pyusbUpgrade ipa-server-dnsUpgrade python3-kdcproxyUpgrade ipa-client-sambaUpgrade ipa-selinuxUpgrade krb5-server-ldapUpgrade ipa-server-trust-ad-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade bind-dyndb-ldap-debugsourceUpgrade krb5-workstationUpgrade python3-ipatestsUpgrade slapi-nisUpgrade ipa-python-compatUpgrade krb5-develUpgrade bind-dyndb-ldap-debuginfoUpgrade krb5-pkinitUpgrade python3-yubicoUpgrade python3-qrcode-coreUpgrade ipa-debuginfoUpgrade ipa-clientUpgrade libkadm5-debuginfoUpgrade libkadm5Upgrade krb5-libs-debuginfoUpgrade python3-ipaserverUpgrade slapi-nis-debuginfoUpgrade krb5-serverUpgrade python3-ipalibUpgrade softhsm-develUpgrade ipa-commonUpgrade ipa-server-trust-adUpgrade ipa-server-debuginfoUpgrade ipa-serverUpgrade opendnssecUpgrade ipa-client-commonUpgrade python3-custodiaUpgrade ipa-client-debuginfoNo solution existsUpgrade krb5-debuginfoUpgrade opendnssec-debuginfoUpgrade krb5-server-debuginfoUpgrade slapi-nis-debugsourceUpgrade softhsmUpgrade python3-jwcrypto | May 15, 2023 | Nov 11, 2020 |
| Rocky_linux | — | Upgrade softhsmUpgrade softhsm-develUpgrade softhsm-debugsourceUpgrade opendnssecUpgrade opendnssec-debugsourceUpgrade slapi-nis-debugsourceUpgrade opendnssec-debuginfoUpgrade slapi-nis-debuginfoUpgrade slapi-nisUpgrade softhsm-debuginfo | Aug 15, 2024 | Nov 11, 2020 |
| Suse | — | Upgrade samba-libs-32bitUpgrade samba-winbind-libsUpgrade samba-libsUpgrade samba-libs-python3Upgrade libsamba-policy0-python3Upgrade samba-client-libsUpgrade samba-ad-dc-libsUpgrade samba-python3Upgrade samba-ldb-ldapUpgrade samba-dsdb-modulesUpgrade sambaUpgrade samba-cephUpgrade samba-winbindUpgrade samba-client-32bitUpgrade libsamba-policy-python3-develUpgrade samba-clientUpgrade samba-develUpgrade samba-winbind-libs-32bitUpgrade samba-client-libs-32bitUpgrade samba-gpupdateUpgrade libsamba-errors-develUpgrade libsamba-errors0Upgrade libsamba-policy-devel | Aug 9, 2024 | Nov 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub