MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-libsUpgrade libkadm5Upgrade krb5-workstationUpgrade krb5-serverUpgrade krb5-develUpgrade krb5-server-ldapUpgrade krb5-pkinit | May 4, 2022 | Nov 6, 2020 |
| Alpine Linux | — | Upgrade krb5 | Nov 26, 2020 | Nov 6, 2020 |
| Amazon Linux Ami 2 | — | Upgrade krb5-debuginfoUpgrade krb5-pkinitUpgrade krb5-libsUpgrade krb5-develUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade libkadm5 | Oct 11, 2022 | Nov 6, 2020 |
| Centos_linux | — | Upgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-server-ldapUpgrade krb5-debuginfoUpgrade krb5-debugsourceUpgrade krb5-workstation-debuginfoUpgrade krb5-libsUpgrade krb5-pkinitUpgrade krb5-libs-debuginfoUpgrade krb5-develUpgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade krb5-workstationUpgrade libkadm5-debuginfoUpgrade libkadm5 | Jun 1, 2021 | Nov 6, 2020 |
| Debian | — | Upgrade krb5 | Nov 9, 2020 | Nov 6, 2020 |
| Freebsd | — | Upgrade mysql56-serverUpgrade mysql57-serverUpgrade mariadb104-serverUpgrade mysql80-serverUpgrade mariadb105-serverUpgrade mariadb103-server | Nov 4, 2022 | Apr 20, 2021 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | Nov 17, 2020 | Nov 6, 2020 |
| Huawei Euleros 2_0_sp2 | — | Upgrade krb5-server-ldapUpgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-libsUpgrade libkadm5Upgrade krb5-pkinitUpgrade krb5-devel | Feb 22, 2021 | Nov 6, 2020 |
| Huawei Euleros 2_0_sp3 | — | Upgrade krb5-libsUpgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade libkadm5Upgrade krb5-server | Jan 20, 2021 | Nov 6, 2020 |
| Huawei Euleros 2_0_sp5 | — | Upgrade krb5-server-ldapUpgrade krb5-workstationUpgrade krb5-develUpgrade libkadm5Upgrade krb5-serverUpgrade krb5-libsUpgrade krb5-pkinit | Mar 24, 2021 | Nov 6, 2020 |
| Huawei Euleros 2_0_sp8 | — | Upgrade krb5-serverUpgrade krb5-workstationUpgrade krb5Upgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-develUpgrade krb5-pkinit | Feb 2, 2021 | Nov 6, 2020 |
| Huawei Euleros 2_0_sp9 | — | Upgrade krb5Upgrade krb5-libsUpgrade krb5-clientUpgrade krb5-server | Jan 5, 2021 | Nov 6, 2020 |
| Oracle Mysql | — | Upgrade to MySQL version 8.0.24 | Jun 15, 2026 | Nov 6, 2020 |
| Oracle_linux | — | Upgrade krb5-develUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-workstationUpgrade krb5-pkinitUpgrade libkadm5Upgrade krb5-server | May 26, 2021 | Nov 6, 2020 |
| Redhat_linux | — | Upgrade krb5-libs-debuginfoUpgrade krb5-debugsourceUpgrade libkadm5Upgrade libkadm5-debuginfoUpgrade krb5-server-ldapNo solution existsUpgrade krb5-libsUpgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade krb5-devel-debuginfoUpgrade krb5-workstationUpgrade krb5-pkinit-debuginfoUpgrade krb5-develUpgrade krb5-workstation-debuginfoUpgrade krb5-debuginfoUpgrade krb5-pkinitUpgrade krb5-server-ldap-debuginfo | May 21, 2021 | Nov 6, 2020 |
| Rocky_linux | — | Upgrade libkadm5Upgrade libkadm5-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-libsUpgrade krb5-devel-debuginfoUpgrade krb5-serverUpgrade krb5-debugsourceUpgrade krb5-workstationUpgrade krb5-pkinitUpgrade krb5-develUpgrade krb5-pkinit-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-server-ldap | Mar 12, 2024 | Nov 6, 2020 |
| Suse | — | Upgrade krb5-serverUpgrade krb5-mini-develUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-devel-32bitUpgrade krb5-plugin-kdb-ldapUpgrade krb5-develUpgrade krb5-miniUpgrade krb5-docUpgrade krb5Upgrade krb5-plugin-preauth-otpUpgrade krb5-clientUpgrade krb5-32bit | Nov 28, 2020 | Nov 6, 2020 |
| Ubuntu | — | Upgrade libkadm5clnt-mit9Upgrade libkrb5-3Upgrade krb5-kpropdUpgrade libkadm5clnt-mit11Upgrade libgssrpc4 (Ubuntu Pro)Upgrade libkadm5srv-mit8 (Ubuntu Pro)Upgrade krb5-multidevUpgrade libkdb5-7 (Ubuntu Pro)Upgrade libk5crypto3Upgrade krb5-pkinit (Ubuntu Pro)Upgrade krb5-admin-serverUpgrade krb5-kdc-ldapUpgrade libkrb5support0 (Ubuntu Pro)Upgrade libkrad0 (Ubuntu Pro)Upgrade libkdb5-9Upgrade krb5-localesUpgrade libkrb5support0Upgrade libgssrpc4Upgrade krb5-k5tlsUpgrade libkadm5clnt-mit9 (Ubuntu Pro)Upgrade krb5-admin-server (Ubuntu Pro)Upgrade krb5-userUpgrade libkadm5srv-mit11Upgrade libgssapi-krb5-2 (Ubuntu Pro)Upgrade krb5-otp (Ubuntu Pro)Upgrade krb5-locales (Ubuntu Pro)Upgrade krb5-pkinitUpgrade libkdb5-8Upgrade krb5-kdc-ldap (Ubuntu Pro)Upgrade krb5-user (Ubuntu Pro)Upgrade krb5-kdcUpgrade libkadm5srv-mit9 (Ubuntu Pro)Upgrade krb5-multidev (Ubuntu Pro)Upgrade krb5-otpUpgrade libgssapi-krb5-2Upgrade libk5crypto3 (Ubuntu Pro)Upgrade libkadm5srv-mit9Upgrade krb5-kdc (Ubuntu Pro)Upgrade libkrad0Upgrade libkrb5-3 (Ubuntu Pro) | Mar 9, 2021 | Nov 6, 2020 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Nov 6, 2020 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub