PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-develUpgrade krb5-server-ldapUpgrade krb5-serverUpgrade krb5-workstationUpgrade libkadm5Upgrade krb5-libsUpgrade krb5-pkinit | Dec 6, 2022 | Nov 28, 2022 |
| Alpine Linux | — | Upgrade krb5Upgrade heimdalUpgrade samba | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade krb5-debuginfoUpgrade krb5-workstationUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-develUpgrade krb5-pkinit | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade krb5 | Jan 25, 2023 | Nov 5, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldapUpgrade libkadm5-debuginfoUpgrade krb5-debugsourceUpgrade krb5-libsUpgrade krb5-workstationUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-develUpgrade krb5-pkinit-opensslUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-pkinitUpgrade krb5-libs-debuginfo | Nov 29, 2022 | Nov 28, 2022 |
| Debian | — | Upgrade krb5Upgrade sambaUpgrade heimdal | Nov 21, 2022 | Nov 21, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade mysql57-serverUpgrade mysql-connector-c++Upgrade mysql80-serverUpgrade krb5-119Upgrade mysql-connector-jUpgrade krb5-120Upgrade krb5-develUpgrade mysql-connector-odbcUpgrade FreeBSDUpgrade krb5 | Nov 16, 2022 | Nov 15, 2022 |
| Gentoo Linux | — | Upgrade app-crypt/heimdal.Upgrade app-crypt/mit-krb5.Upgrade net-fs/samba. | Sep 18, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade krb5-clientUpgrade krb5Upgrade krb5-serverUpgrade krb5-libs | Feb 13, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade samba-winbind-clientsUpgrade samba-winbindUpgrade libsmbclientUpgrade samba-libsUpgrade sambaUpgrade samba-clientUpgrade samba-common-toolsUpgrade samba-winbind-modulesUpgrade libwbclientUpgrade samba-common | Mar 8, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade sambaUpgrade libwbclientUpgrade samba-client-libsUpgrade samba-winbindUpgrade samba-pythonUpgrade samba-libsUpgrade samba-clientUpgrade samba-commonUpgrade libsmbclientUpgrade samba-common-toolsUpgrade samba-winbind-clientsUpgrade samba-winbind-modulesUpgrade samba-common-libs | Jun 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-test-libsUpgrade python2-samba-testUpgrade python3-samba-testUpgrade samba-common-libsUpgrade libsmbclientUpgrade samba-commonUpgrade samba-winbindUpgrade python2-sambaUpgrade samba-winbind-modulesUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade samba-dc-libsUpgrade samba-winbind-krb5-locatorUpgrade sambaUpgrade samba-common-toolsUpgrade ctdbUpgrade samba-krb5-printingUpgrade samba-testUpgrade samba-client-libsUpgrade libwbclientUpgrade ctdb-testsUpgrade python3-sambaUpgrade samba-libsUpgrade samba-pidl | Feb 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade krb5Upgrade krb5-libsUpgrade krb5-clientUpgrade krb5-server | Jan 9, 2023 | Dec 25, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 11, 2023 |
| Oracle_linux | — | Upgrade krb5-serverUpgrade krb5-develUpgrade krb5-workstationUpgrade krb5-server-ldapUpgrade krb5-pkinitUpgrade krb5-pkinit-opensslUpgrade libkadm5Upgrade krb5-libs | Nov 29, 2022 | Nov 15, 2022 |
| Redhat_linux | — | Upgrade krb5-workstationUpgrade krb5-debugsourceUpgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade libkadm5Upgrade krb5-libs-debuginfoUpgrade libkadm5-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-develUpgrade krb5-server-ldap-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-pkinit | Nov 29, 2022 | Nov 28, 2022 |
| Rocky_linux | — | Upgrade krb5-server-ldap-debuginfoUpgrade krb5-workstationUpgrade krb5-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldapUpgrade krb5-debugsourceUpgrade krb5-serverUpgrade krb5-pkinitUpgrade krb5-develUpgrade libkadm5Upgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-libsUpgrade libkadm5-debuginfo | Mar 12, 2024 | Dec 25, 2022 |
| Samba | — | Upgrade to Samba 4.17.3 or later.Upgrade to Samba 4.15.12 or later.Upgrade to Samba 4.16.7 or later. | Dec 25, 2022 | Dec 25, 2022 |
| Suse | — | Upgrade krb5-32bitUpgrade samba-dsdb-modulesUpgrade libhx509-5Upgrade krb5-develUpgrade samba-devel-32bitUpgrade samba-libs-32bitUpgrade krb5-docUpgrade libasn1-8Upgrade krb5-clientUpgrade samba-testUpgrade libkadm5clnt7Upgrade samba-client-libsUpgrade libkdc2Upgrade samba-client-32bitUpgrade krb5-plugin-preauth-spakeUpgrade ctdbUpgrade libsamba-policy0-python3-32bitUpgrade samba-libsUpgrade libkafs0Upgrade samba-client-libs-32bitUpgrade libheimedit0Upgrade samba-develUpgrade libkrb5-26Upgrade samba-libs-python3-64bitUpgrade krb5Upgrade libsl0Upgrade krb5-plugin-preauth-otpUpgrade libsamba-policy0-python3-64bitUpgrade libhdb9Upgrade libgssapi3Upgrade krb5-devel-32bitUpgrade libsamba-policy0-python3Upgrade libheimntlm0Upgrade samba-ad-dc-libs-32bitUpgrade krb5-miniUpgrade samba-gpupdateUpgrade sambaUpgrade samba-client-64bitUpgrade libhcrypto4Upgrade samba-winbind-libs-32bitUpgrade samba-libs-64bitUpgrade libroken18Upgrade libkadm5srv8Upgrade samba-ad-dcUpgrade samba-clientUpgrade samba-ldb-ldapUpgrade libsamba-policy-python3-develUpgrade samba-libs-python3Upgrade krb5-plugin-kdb-ldapUpgrade krb5-mini-develUpgrade samba-winbind-libsUpgrade samba-toolUpgrade libheimdal-develUpgrade krb5-plugin-preauth-pkinitUpgrade libheimbase1Upgrade samba-libs-python3-32bitUpgrade samba-python3Upgrade samba-cephUpgrade libwind0Upgrade libotp0Upgrade krb5-serverUpgrade samba-ad-dc-libsUpgrade samba-winbindUpgrade samba-docUpgrade libsamba-policy-develUpgrade ctdb-pcp-pmda | Nov 22, 2022 | Nov 21, 2022 |
| Ubuntu | — | Upgrade libgssapi3-heimdalUpgrade samba (Ubuntu Pro)Upgrade libgssapi-krb5-2 (Ubuntu Pro)Upgrade libkdb5-8 (Ubuntu Pro)Upgrade libgssapi-krb5-2Upgrade libhdb9-heimdalUpgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade libkdb5-10Upgrade krb5-userUpgrade krb5-kdc (Ubuntu Pro)Upgrade libhx509-5-heimdalUpgrade libkdb5-9Upgrade krb5-user (Ubuntu Pro)Upgrade libkdb5-7 (Ubuntu Pro)Upgrade krb5-kdcUpgrade sambaUpgrade libasn1-8-heimdalUpgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade krb5-admin-server (Ubuntu Pro)Upgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade libhdb9-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdalUpgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade krb5-admin-server | Jan 13, 2023 | Nov 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub