A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.
CVSS Details
- CVSS 3.1 Base Score: 6.6
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade ipa-client-epnUpgrade ipa-healthcheck-coreUpgrade slapi-nisUpgrade ipa-selinuxUpgrade ipa-server-dnsUpgrade python3-kdcproxyUpgrade python3-qrcodeUpgrade python3-ipatestsUpgrade ipa-healthcheckUpgrade krb5-pkinitUpgrade krb5-libsUpgrade krb5-develUpgrade ipa-server-trust-adUpgrade python3-qrcode-coreUpgrade softhsm-develUpgrade ipa-client-sambaUpgrade python3-pyusbUpgrade ipa-commonUpgrade libkadm5Upgrade ipa-clientUpgrade custodiaUpgrade python3-ipaclientUpgrade python3-ipalibUpgrade ipa-serverUpgrade softhsmUpgrade bind-dyndb-ldapUpgrade python3-ipaserverUpgrade krb5-workstationUpgrade ipa-python-compatUpgrade krb5-serverUpgrade ipa-client-commonUpgrade opendnssecUpgrade python3-jwcryptoUpgrade python3-yubicoUpgrade ipa-server-commonUpgrade krb5-server-ldapUpgrade python3-custodia | May 15, 2023 | Nov 11, 2020 |
| Amazon_linux | — | Upgrade samba | Dec 10, 2022 | Nov 11, 2020 |
| Amazon_linux_2023 | — | Upgrade samba-dcerpc-debuginfoUpgrade samba-winbind-krb5-locator-debuginfoUpgrade samba-krb5-printingUpgrade libwbclientUpgrade samba-client-debuginfoUpgrade samba-test-debuginfoUpgrade samba-ldb-ldap-modulesUpgrade samba-libsUpgrade libsmbclient-develUpgrade python3-samba-debuginfoUpgrade samba-winbind-clients-debuginfoUpgrade samba-common-tools-debuginfoUpgrade libwbclient-develUpgrade samba-dcerpcUpgrade samba-usersharesUpgrade python3-sambaUpgrade samba-ldb-ldap-modules-debuginfoUpgrade samba-winbind-krb5-locatorUpgrade samba-krb5-printing-debuginfoUpgrade samba-clientUpgrade samba-common-toolsUpgrade libsmbclientUpgrade samba-client-libsUpgrade samba-winbind-debuginfoUpgrade python3-samba-develUpgrade libnetapiUpgrade samba-testUpgrade samba-debuginfoUpgrade samba-common-libsUpgrade python3-samba-testUpgrade samba-commonUpgrade samba-winbind-modules-debuginfoUpgrade samba-test-libs-debuginfoUpgrade libsmbclient-debuginfoUpgrade samba-client-libs-debuginfoUpgrade sambaUpgrade samba-common-libs-debuginfoUpgrade samba-winbind-modulesUpgrade samba-winbindUpgrade samba-winbind-clientsUpgrade samba-develUpgrade samba-libs-debuginfoUpgrade samba-dc-libs-debuginfoUpgrade samba-vfs-iouring-debuginfoUpgrade samba-dc-libsUpgrade libnetapi-debuginfoUpgrade libnetapi-develUpgrade samba-pidlUpgrade samba-test-libsUpgrade samba-vfs-iouringUpgrade samba-debugsourceUpgrade libwbclient-debuginfo | Feb 17, 2025 | Nov 10, 2020 |
| Centos_linux | — | Upgrade krb5-debuginfoUpgrade krb5-debugsourceUpgrade bind-dyndb-ldap-debugsourceUpgrade python3-ipaclientUpgrade python3-ipalibUpgrade slapi-nis-debuginfoUpgrade python3-ipatestsUpgrade bind-dyndb-ldapUpgrade ipa-client-sambaUpgrade ipa-server-commonUpgrade ipa-server-trust-adUpgrade ipa-server-trust-ad-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade python3-qrcodeUpgrade custodiaUpgrade python3-ipaserverUpgrade krb5-workstation-debuginfoUpgrade softhsm-debuginfoUpgrade krb5-server-ldapUpgrade krb5-server-ldap-debuginfoUpgrade ipa-debugsourceUpgrade ipa-healthcheckUpgrade ipa-healthcheck-coreUpgrade ipa-selinuxUpgrade python3-qrcode-coreUpgrade softhsm-debugsourceUpgrade krb5-libs-debuginfoUpgrade ipa-server-debuginfoUpgrade python3-yubicoUpgrade krb5-pkinitUpgrade opendnssecUpgrade ipa-serverUpgrade python3-kdcproxyUpgrade bind-dyndb-ldap-debuginfoUpgrade ipa-server-dnsUpgrade opendnssec-debugsourceUpgrade krb5-workstationUpgrade krb5-develUpgrade python3-pyusbUpgrade python3-custodiaUpgrade libkadm5Upgrade ipa-client-debuginfoUpgrade krb5-serverUpgrade krb5-server-debuginfoUpgrade python3-jwcryptoUpgrade ipa-client-epnUpgrade ipa-client-commonUpgrade ipa-debuginfoUpgrade libkadm5-debuginfoUpgrade krb5-libsUpgrade ipa-clientUpgrade ipa-commonUpgrade softhsm-develUpgrade ipa-python-compatUpgrade softhsmUpgrade slapi-nis-debugsourceUpgrade slapi-nisUpgrade opendnssec-debuginfo | May 15, 2023 | Nov 11, 2020 |
| Gentoo Linux | — | Upgrade net-fs/samba. | Sep 18, 2023 | Nov 11, 2020 |
| Msft | — | 2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5004307)2021-07 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5004237)2021-07 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5004285)2021-07 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5004285)2021-07 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5004307)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB4586808)2020-11 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB4586781)2021-07 Cumulative Update for Microsoft Windows Server 2012 R2 (KB5004285)2021-07 Security Only Quality Update for Windows 7 for x64-based Systems (KB5004307)2021-04 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5001392)2020-12 Security Only Quality Update for Windows 7 for x86-based Systems (KB4592503)2020-11 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB4586781)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5001383)2021-04 Cumulative Update for Windows Server, version 2004 for x64-based Systems (KB5001330)2021-04 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5001330)2021-07 Cumulative Update for Windows Server, version 20H2 for x64-based Systems (KB5004237)2020-11 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB4586823)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5004302)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB5001392)2021-04 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB5001393)2021-07 Cumulative Update for Microsoft Windows Server 2012 (KB5004302)2021-07 Cumulative Update for Microsoft Windows Server 2019, version 1809 (KB5004244)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x64-based Systems (KB4592503)2020-11 Cumulative Update for Windows Server, version 1903 for x64-based Systems (KB4586786)2020-11 Security Only Quality Update for Windows 8.1 for x86-based Systems (KB4586823)2021-07 Cumulative Update for Microsoft Windows Server 2016, version 1607 (KB5004238)2021-07 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5004299)2021-07 Security Only Quality Update for Windows 7 for x86-based Systems (KB5004307)2021-07 Security Only Quality Update for Windows Embedded 8 Standard for x64-based Systems (KB5004302)2021-04 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB5001383)2021-04 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB5001337)2020-12 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB4592503)2020-11 Security Only Quality Update for Windows Embedded 8 Standard for x86-based Systems (KB4586808)2021-04 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB5001392)2020-12 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB4592504)2020-12 Security Only Quality Update for Windows 7 for x64-based Systems (KB4592503)2021-07 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5004299)2021-07 Security Only Quality Update for Windows Server 2008 R2 for x64-based Systems (KB5004307)2020-12 Security Only Quality Update for Windows Embedded Standard 7 for x86-based Systems (KB4592503)2020-11 Cumulative Update for Windows Server, version 1909 for x64-based Systems (KB4586786)2021-04 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB5001332)2021-04 Security Only Quality Update for Windows 8.1 for x64-based Systems (KB5001393)2020-12 Security Only Quality Update for Windows Server 2008 for x86-based Systems (KB4592504)2021-04 Security Only Quality Update for Windows Server 2008 for x64-based Systems (KB5001332) | Nov 10, 2020 | Nov 10, 2020 |
| Oracle Solaris | — | Upgrade library/samba/libsmbclient to version 4.13.8-11.4.42.0.1.113.0 on Solaris 11.4Upgrade service/network/samba to version 4.13.14-11.4.42.0.1.113.0 on Solaris 11.4 | Feb 17, 2022 | Nov 11, 2020 |
| Oracle_linux | — | Upgrade slapi-nisUpgrade krb5-workstationUpgrade python3-ipatestsUpgrade ipa-server-commonUpgrade custodiaUpgrade python3-ipalibUpgrade python3-kdcproxyUpgrade krb5-serverUpgrade python3-yubicoUpgrade ipa-clientUpgrade ipa-healthcheckUpgrade ipa-selinuxUpgrade softhsm-develUpgrade ipa-commonUpgrade ipa-client-commonUpgrade ipa-serverUpgrade ipa-server-trust-adUpgrade python3-pyusbUpgrade ipa-healthcheck-coreUpgrade bind-dyndb-ldapUpgrade krb5-pkinitUpgrade krb5-server-ldapUpgrade krb5-develUpgrade ipa-python-compatUpgrade ipa-client-sambaUpgrade softhsmUpgrade python3-ipaclientUpgrade ipa-client-epnUpgrade ipa-server-dnsUpgrade python3-qrcode-coreUpgrade opendnssecUpgrade libkadm5Upgrade python3-jwcryptoUpgrade python3-qrcodeUpgrade python3-custodiaUpgrade krb5-libsUpgrade python3-ipaserver | May 17, 2023 | Nov 10, 2020 |
| Redhat_linux | — | Upgrade krb5-server-debuginfoUpgrade ipa-debuginfoUpgrade softhsm-develUpgrade bind-dyndb-ldap-debuginfoUpgrade opendnssec-debuginfoUpgrade krb5-debuginfoUpgrade ipa-commonUpgrade krb5-workstationUpgrade ipa-server-debuginfoUpgrade python3-custodiaUpgrade slapi-nisUpgrade python3-ipalibNo solution existsUpgrade slapi-nis-debuginfoUpgrade ipa-server-trust-adUpgrade libkadm5-debuginfoUpgrade slapi-nis-debugsourceUpgrade opendnssecUpgrade python3-qrcode-coreUpgrade krb5-libs-debuginfoUpgrade python3-ipaserverUpgrade ipa-clientUpgrade softhsmUpgrade python3-jwcryptoUpgrade ipa-client-commonUpgrade krb5-serverUpgrade python3-yubicoUpgrade libkadm5Upgrade ipa-python-compatUpgrade krb5-develUpgrade ipa-client-debuginfoUpgrade ipa-serverUpgrade python3-ipatestsUpgrade krb5-pkinitUpgrade opendnssec-debugsourceUpgrade krb5-pkinit-debuginfoUpgrade softhsm-debugsourceUpgrade bind-dyndb-ldapUpgrade softhsm-debuginfoUpgrade ipa-server-trust-ad-debuginfoUpgrade custodiaUpgrade krb5-workstation-debuginfoUpgrade ipa-debugsourceUpgrade krb5-libsUpgrade krb5-server-ldap-debuginfoUpgrade ipa-healthcheckUpgrade ipa-client-epnUpgrade krb5-devel-debuginfoUpgrade krb5-debugsourceUpgrade ipa-selinuxUpgrade bind-dyndb-ldap-debugsourceUpgrade python3-kdcproxyUpgrade ipa-server-commonUpgrade ipa-server-dnsUpgrade krb5-server-ldapUpgrade ipa-healthcheck-coreUpgrade python3-pyusbUpgrade python3-ipaclientUpgrade ipa-client-sambaUpgrade python3-qrcode | May 15, 2023 | Nov 11, 2020 |
| Rocky_linux | — | Upgrade opendnssec-debugsourceUpgrade softhsm-develUpgrade softhsmUpgrade softhsm-debugsourceUpgrade opendnssecUpgrade softhsm-debuginfoUpgrade opendnssec-debuginfoUpgrade slapi-nis-debugsourceUpgrade slapi-nis-debuginfoUpgrade slapi-nis | Aug 15, 2024 | Nov 11, 2020 |
| Suse | — | Upgrade libsamba-policy-develUpgrade samba-clientUpgrade samba-client-libs-32bitUpgrade samba-client-32bitUpgrade samba-gpupdateUpgrade libsamba-errors-develUpgrade libsamba-policy-python3-develUpgrade samba-develUpgrade libsamba-errors0Upgrade samba-winbind-libs-32bitUpgrade samba-libs-python3Upgrade samba-client-libsUpgrade samba-python3Upgrade samba-cephUpgrade samba-winbind-libsUpgrade samba-ad-dc-libsUpgrade sambaUpgrade libsamba-policy0-python3Upgrade samba-libs-32bitUpgrade samba-winbindUpgrade samba-ldb-ldapUpgrade samba-libsUpgrade samba-dsdb-modules | Aug 9, 2024 | Nov 11, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub