PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-server-ldapUpgrade krb5-serverUpgrade krb5-develUpgrade libkadm5Upgrade krb5-workstationUpgrade krb5-pkinitUpgrade krb5-libs | Dec 6, 2022 | Nov 28, 2022 |
| Alpine Linux | — | Upgrade heimdalUpgrade sambaUpgrade krb5 | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade krb5-libsUpgrade krb5-server-ldapUpgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-workstationUpgrade krb5-debuginfo | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade krb5 | Jan 25, 2023 | Nov 5, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade krb5-serverUpgrade krb5-libsUpgrade krb5-debugsourceUpgrade libkadm5Upgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade libkadm5-debuginfoUpgrade krb5-develUpgrade krb5-devel-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-pkinitUpgrade krb5-libs-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinit-openssl | Nov 29, 2022 | Nov 28, 2022 |
| Debian | — | Upgrade sambaUpgrade krb5Upgrade heimdal | Nov 21, 2022 | Nov 21, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade mysql80-serverUpgrade krb5-develUpgrade mysql-connector-c++Upgrade krb5-119Upgrade mysql57-serverUpgrade mysql-connector-odbcUpgrade mysql-connector-jUpgrade krb5-120Upgrade krb5Upgrade FreeBSD | Nov 16, 2022 | Nov 15, 2022 |
| Gentoo Linux | — | Upgrade app-crypt/heimdal.Upgrade net-fs/samba.Upgrade app-crypt/mit-krb5. | Sep 18, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade krb5Upgrade krb5-clientUpgrade krb5-serverUpgrade krb5-libs | Feb 13, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade sambaUpgrade samba-common-toolsUpgrade samba-libsUpgrade samba-winbind-clientsUpgrade samba-winbindUpgrade samba-winbind-modulesUpgrade libsmbclientUpgrade samba-clientUpgrade libwbclientUpgrade samba-common | Mar 8, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade samba-common-libsUpgrade samba-commonUpgrade libsmbclientUpgrade samba-common-toolsUpgrade samba-winbind-modulesUpgrade samba-clientUpgrade samba-winbind-clientsUpgrade sambaUpgrade samba-libsUpgrade samba-client-libsUpgrade samba-pythonUpgrade libwbclientUpgrade samba-winbind | Jun 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-client-libsUpgrade samba-testUpgrade libwbclientUpgrade samba-libsUpgrade samba-pidlUpgrade python3-sambaUpgrade ctdb-testsUpgrade samba-krb5-printingUpgrade samba-common-libsUpgrade samba-common-toolsUpgrade samba-winbind-krb5-locatorUpgrade python3-samba-testUpgrade python2-samba-testUpgrade libsmbclientUpgrade samba-dc-libsUpgrade samba-winbindUpgrade samba-commonUpgrade sambaUpgrade ctdbUpgrade python2-sambaUpgrade samba-clientUpgrade samba-test-libsUpgrade samba-winbind-clientsUpgrade samba-winbind-modules | Feb 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade krb5-serverUpgrade krb5-libsUpgrade krb5-clientUpgrade krb5 | Jan 9, 2023 | Dec 25, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 11, 2023 |
| Oracle_linux | — | Upgrade krb5-libsUpgrade krb5-develUpgrade krb5-server-ldapUpgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-pkinitUpgrade krb5-pkinit-opensslUpgrade libkadm5 | Nov 29, 2022 | Nov 15, 2022 |
| Redhat_linux | — | Upgrade krb5-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-pkinitUpgrade krb5-develUpgrade krb5-devel-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-server-debuginfoUpgrade libkadm5Upgrade libkadm5-debuginfoUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-libs-debuginfoUpgrade krb5-workstationUpgrade krb5-debugsourceUpgrade krb5-server | Nov 29, 2022 | Nov 28, 2022 |
| Rocky_linux | — | Upgrade krb5-debugsourceUpgrade krb5-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-workstationUpgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldapUpgrade krb5-server-debuginfoUpgrade krb5-develUpgrade libkadm5Upgrade krb5-libsUpgrade libkadm5-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-serverUpgrade krb5-pkinit | Mar 12, 2024 | Dec 25, 2022 |
| Samba | — | Upgrade to Samba 4.17.3 or later.Upgrade to Samba 4.15.12 or later.Upgrade to Samba 4.16.7 or later. | Dec 25, 2022 | Dec 25, 2022 |
| Suse | — | Upgrade libsl0Upgrade samba-dsdb-modulesUpgrade samba-client-libsUpgrade samba-develUpgrade ctdbUpgrade krb5-develUpgrade libkdc2Upgrade samba-client-32bitUpgrade krb5Upgrade libkadm5clnt7Upgrade samba-client-libs-32bitUpgrade libheimedit0Upgrade samba-libs-32bitUpgrade samba-libsUpgrade krb5-devel-32bitUpgrade samba-testUpgrade krb5-clientUpgrade samba-libs-python3-64bitUpgrade krb5-docUpgrade libkrb5-26Upgrade samba-devel-32bitUpgrade libsamba-policy0-python3Upgrade libasn1-8Upgrade libsamba-policy0-python3-64bitUpgrade libsamba-policy0-python3-32bitUpgrade libkafs0Upgrade libhdb9Upgrade krb5-plugin-preauth-spakeUpgrade krb5-plugin-preauth-otpUpgrade krb5-32bitUpgrade libgssapi3Upgrade libhx509-5Upgrade samba-ad-dc-libs-32bitUpgrade libroken18Upgrade samba-libs-python3-32bitUpgrade libheimntlm0Upgrade samba-gpupdateUpgrade samba-libs-python3Upgrade krb5-miniUpgrade libsamba-policy-python3-develUpgrade samba-winbindUpgrade libotp0Upgrade krb5-serverUpgrade samba-python3Upgrade samba-ad-dc-libsUpgrade krb5-plugin-kdb-ldapUpgrade libwind0Upgrade krb5-plugin-preauth-pkinitUpgrade krb5-mini-develUpgrade samba-winbind-libsUpgrade libheimdal-develUpgrade samba-client-64bitUpgrade libhcrypto4Upgrade samba-winbind-libs-32bitUpgrade samba-cephUpgrade samba-docUpgrade samba-toolUpgrade samba-libs-64bitUpgrade ctdb-pcp-pmdaUpgrade libheimbase1Upgrade libsamba-policy-develUpgrade sambaUpgrade libkadm5srv8Upgrade samba-ldb-ldapUpgrade samba-ad-dcUpgrade samba-client | Nov 22, 2022 | Nov 21, 2022 |
| Ubuntu | — | Upgrade krb5-kdc (Ubuntu Pro)Upgrade libhdb9-heimdalUpgrade libkdb5-10Upgrade libgssapi-krb5-2Upgrade libgssapi-krb5-2 (Ubuntu Pro)Upgrade libkdb5-7 (Ubuntu Pro)Upgrade libhx509-5-heimdalUpgrade libgssapi3-heimdalUpgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade krb5-user (Ubuntu Pro)Upgrade krb5-userUpgrade krb5-kdcUpgrade libkdb5-9Upgrade samba (Ubuntu Pro)Upgrade libkdb5-8 (Ubuntu Pro)Upgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade libasn1-8-heimdalUpgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade krb5-admin-server (Ubuntu Pro)Upgrade libkrb5-26-heimdalUpgrade libhdb9-heimdal (Ubuntu Pro)Upgrade krb5-admin-serverUpgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade samba | Jan 13, 2023 | Nov 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub