PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-develUpgrade krb5-server-ldapUpgrade libkadm5Upgrade krb5-pkinitUpgrade krb5-libs | Dec 6, 2022 | Nov 28, 2022 |
| Alpine Linux | — | Upgrade heimdalUpgrade sambaUpgrade krb5 | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade krb5-server-ldapUpgrade krb5-pkinitUpgrade krb5-develUpgrade krb5-libsUpgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-debuginfoUpgrade libkadm5 | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade krb5 | Jan 25, 2023 | Nov 5, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-debuginfoUpgrade krb5-pkinitUpgrade krb5-develUpgrade krb5-pkinit-opensslUpgrade krb5-server-ldapUpgrade krb5-pkinit-debuginfoUpgrade krb5-workstationUpgrade krb5-serverUpgrade krb5-debugsourceUpgrade krb5-libsUpgrade libkadm5-debuginfoUpgrade libkadm5 | Nov 29, 2022 | Nov 28, 2022 |
| Debian | — | Upgrade krb5Upgrade sambaUpgrade heimdal | Nov 21, 2022 | Nov 21, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade FreeBSDUpgrade krb5Upgrade mysql-connector-jUpgrade krb5-120Upgrade krb5-develUpgrade mysql-connector-c++Upgrade krb5-119Upgrade mysql57-serverUpgrade mysql80-serverUpgrade mysql-connector-odbc | Nov 16, 2022 | Nov 15, 2022 |
| Gentoo Linux | — | Upgrade app-crypt/heimdal.Upgrade app-crypt/mit-krb5.Upgrade net-fs/samba. | Sep 18, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade krb5-libsUpgrade krb5-serverUpgrade krb5Upgrade krb5-client | Feb 13, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade sambaUpgrade samba-winbind-modulesUpgrade samba-winbindUpgrade samba-libsUpgrade samba-clientUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-common-toolsUpgrade libwbclientUpgrade samba-common | Mar 8, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade samba-common-libsUpgrade samba-commonUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade samba-winbind-modulesUpgrade samba-common-toolsUpgrade samba-winbindUpgrade samba-pythonUpgrade libwbclientUpgrade samba-libsUpgrade samba-client-libsUpgrade samba | Jun 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-dc-libsUpgrade samba-winbind-clientsUpgrade ctdbUpgrade samba-common-toolsUpgrade sambaUpgrade samba-winbind-modulesUpgrade python2-sambaUpgrade samba-clientUpgrade samba-test-libsUpgrade samba-common-libsUpgrade python2-samba-testUpgrade samba-commonUpgrade samba-winbindUpgrade python3-samba-testUpgrade samba-winbind-krb5-locatorUpgrade libsmbclientUpgrade samba-pidlUpgrade samba-krb5-printingUpgrade ctdb-testsUpgrade samba-testUpgrade libwbclientUpgrade samba-client-libsUpgrade samba-libsUpgrade python3-samba | Feb 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade krb5-libsUpgrade krb5-clientUpgrade krb5-serverUpgrade krb5 | Jan 9, 2023 | Dec 25, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 11, 2023 |
| Oracle_linux | — | Upgrade krb5-libsUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-pkinit-opensslUpgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-workstation | Nov 29, 2022 | Nov 15, 2022 |
| Redhat_linux | — | Upgrade libkadm5Upgrade krb5-workstationUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-serverUpgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-debugsourceUpgrade libkadm5-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-develUpgrade krb5-pkinit-debuginfoUpgrade krb5-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-pkinit | Nov 29, 2022 | Nov 28, 2022 |
| Rocky_linux | — | Upgrade krb5-pkinitUpgrade krb5-develUpgrade libkadm5Upgrade krb5-libsUpgrade krb5-serverUpgrade krb5-server-debuginfoUpgrade libkadm5-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-debugsourceUpgrade krb5-workstationUpgrade krb5-server-ldap-debuginfoUpgrade krb5-debuginfoUpgrade krb5-server-ldapUpgrade krb5-pkinit-debuginfoUpgrade krb5-devel-debuginfo | Mar 12, 2024 | Dec 25, 2022 |
| Samba | — | Upgrade to Samba 4.15.12 or later.Upgrade to Samba 4.17.3 or later.Upgrade to Samba 4.16.7 or later. | Dec 25, 2022 | Dec 25, 2022 |
| Suse | — | Upgrade krb5Upgrade krb5-devel-32bitUpgrade libsamba-policy0-python3Upgrade libhdb9Upgrade krb5-plugin-preauth-spakeUpgrade samba-libs-python3-64bitUpgrade libsl0Upgrade libhx509-5Upgrade libsamba-policy0-python3-64bitUpgrade samba-dsdb-modulesUpgrade libgssapi3Upgrade samba-devel-32bitUpgrade krb5-32bitUpgrade libkdc2Upgrade samba-libsUpgrade samba-client-libsUpgrade libkafs0Upgrade samba-libs-32bitUpgrade krb5-docUpgrade samba-client-libs-32bitUpgrade libsamba-policy0-python3-32bitUpgrade ctdbUpgrade krb5-develUpgrade samba-develUpgrade libkrb5-26Upgrade libasn1-8Upgrade samba-testUpgrade libheimedit0Upgrade libkadm5clnt7Upgrade samba-client-32bitUpgrade krb5-plugin-preauth-otpUpgrade krb5-clientUpgrade libkadm5srv8Upgrade krb5-plugin-kdb-ldapUpgrade samba-gpupdateUpgrade samba-ad-dcUpgrade libheimntlm0Upgrade samba-clientUpgrade libwind0Upgrade samba-cephUpgrade krb5-miniUpgrade libheimbase1Upgrade krb5-plugin-preauth-pkinitUpgrade samba-winbind-libs-32bitUpgrade krb5-serverUpgrade samba-winbindUpgrade samba-python3Upgrade samba-ad-dc-libsUpgrade libotp0Upgrade samba-libs-64bitUpgrade samba-client-64bitUpgrade samba-ad-dc-libs-32bitUpgrade samba-winbind-libsUpgrade samba-toolUpgrade libheimdal-develUpgrade krb5-mini-develUpgrade libhcrypto4Upgrade samba-libs-python3-32bitUpgrade samba-docUpgrade samba-libs-python3Upgrade samba-ldb-ldapUpgrade sambaUpgrade libsamba-policy-develUpgrade libroken18Upgrade ctdb-pcp-pmdaUpgrade libsamba-policy-python3-devel | Nov 22, 2022 | Nov 21, 2022 |
| Ubuntu | — | Upgrade libkdb5-9Upgrade libkdb5-8 (Ubuntu Pro)Upgrade libgssapi-krb5-2Upgrade krb5-userUpgrade libgssapi-krb5-2 (Ubuntu Pro)Upgrade libkdb5-10Upgrade krb5-kdc (Ubuntu Pro)Upgrade libkdb5-7 (Ubuntu Pro)Upgrade libhx509-5-heimdalUpgrade libhdb9-heimdalUpgrade samba (Ubuntu Pro)Upgrade krb5-user (Ubuntu Pro)Upgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade krb5-kdcUpgrade libgssapi3-heimdalUpgrade krb5-admin-serverUpgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade libhdb9-heimdal (Ubuntu Pro)Upgrade libasn1-8-heimdalUpgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade sambaUpgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdalUpgrade krb5-admin-server (Ubuntu Pro) | Jan 13, 2023 | Nov 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub