PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-pkinitUpgrade krb5-libsUpgrade krb5-server-ldapUpgrade krb5-serverUpgrade krb5-develUpgrade libkadm5Upgrade krb5-workstation | Dec 6, 2022 | Nov 28, 2022 |
| Alpine Linux | — | Upgrade krb5Upgrade sambaUpgrade heimdal | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade krb5-workstationUpgrade libkadm5Upgrade krb5-debuginfoUpgrade krb5-serverUpgrade krb5-pkinitUpgrade krb5-server-ldapUpgrade krb5-develUpgrade krb5-libs | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade krb5 | Jan 25, 2023 | Nov 5, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade krb5-pkinitUpgrade krb5-libs-debuginfoUpgrade krb5-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-develUpgrade krb5-pkinit-opensslUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-serverUpgrade krb5-libsUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade libkadm5-debuginfoUpgrade libkadm5Upgrade krb5-pkinit-debuginfoUpgrade krb5-debugsource | Nov 29, 2022 | Nov 28, 2022 |
| Debian | — | Upgrade krb5Upgrade sambaUpgrade heimdal | Nov 21, 2022 | Nov 21, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade mysql57-serverUpgrade krb5-119Upgrade mysql-connector-odbcUpgrade krb5-120Upgrade mysql-connector-c++Upgrade mysql80-serverUpgrade krb5-develUpgrade mysql-connector-jUpgrade krb5Upgrade FreeBSD | Nov 16, 2022 | Nov 15, 2022 |
| Gentoo Linux | — | Upgrade app-crypt/heimdal.Upgrade app-crypt/mit-krb5.Upgrade net-fs/samba. | Sep 18, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade krb5Upgrade krb5-clientUpgrade krb5-libsUpgrade krb5-server | Feb 13, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade samba-libsUpgrade samba-winbindUpgrade samba-winbind-modulesUpgrade sambaUpgrade samba-common-toolsUpgrade samba-clientUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-commonUpgrade libwbclient | Mar 8, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade samba-winbindUpgrade samba-libsUpgrade libwbclientUpgrade samba-pythonUpgrade sambaUpgrade samba-client-libsUpgrade samba-clientUpgrade samba-common-toolsUpgrade samba-winbind-modulesUpgrade samba-commonUpgrade libsmbclientUpgrade samba-winbind-clientsUpgrade samba-common-libs | Jun 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-test-libsUpgrade samba-winbindUpgrade samba-commonUpgrade libsmbclientUpgrade samba-common-libsUpgrade samba-winbind-krb5-locatorUpgrade python3-samba-testUpgrade python2-samba-testUpgrade samba-common-toolsUpgrade sambaUpgrade ctdbUpgrade samba-clientUpgrade samba-winbind-clientsUpgrade samba-winbind-modulesUpgrade python2-sambaUpgrade samba-dc-libsUpgrade samba-pidlUpgrade samba-krb5-printingUpgrade ctdb-testsUpgrade samba-libsUpgrade samba-testUpgrade samba-client-libsUpgrade libwbclientUpgrade python3-samba | Feb 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade krb5-libsUpgrade krb5Upgrade krb5-serverUpgrade krb5-client | Jan 9, 2023 | Dec 25, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 11, 2023 |
| Oracle_linux | — | Upgrade krb5-workstationUpgrade krb5-server-ldapUpgrade libkadm5Upgrade krb5-develUpgrade krb5-serverUpgrade krb5-pkinitUpgrade krb5-pkinit-opensslUpgrade krb5-libs | Nov 29, 2022 | Nov 15, 2022 |
| Redhat_linux | — | Upgrade krb5-pkinit-debuginfoUpgrade krb5-pkinitUpgrade krb5-develUpgrade krb5-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-serverUpgrade krb5-server-debuginfoUpgrade krb5-libsUpgrade libkadm5Upgrade krb5-workstationUpgrade libkadm5-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-debugsourceUpgrade krb5-server-ldap | Nov 29, 2022 | Nov 28, 2022 |
| Rocky_linux | — | Upgrade krb5-pkinitUpgrade krb5-serverUpgrade krb5-develUpgrade krb5-libs-debuginfoUpgrade krb5-libsUpgrade libkadm5Upgrade krb5-server-debuginfoUpgrade libkadm5-debuginfoUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade krb5-workstation-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-debugsourceUpgrade krb5-debuginfo | Mar 12, 2024 | Dec 25, 2022 |
| Samba | — | Upgrade to Samba 4.17.3 or later.Upgrade to Samba 4.16.7 or later.Upgrade to Samba 4.15.12 or later. | Dec 25, 2022 | Dec 25, 2022 |
| Suse | — | Upgrade samba-toolUpgrade krb5-mini-develUpgrade krb5-plugin-preauth-pkinitUpgrade samba-winbindUpgrade samba-libs-python3-32bitUpgrade krb5-serverUpgrade samba-client-64bitUpgrade samba-gpupdateUpgrade ctdb-pcp-pmdaUpgrade libroken18Upgrade libsamba-policy-develUpgrade libheimntlm0Upgrade samba-ad-dcUpgrade libotp0Upgrade sambaUpgrade samba-python3Upgrade libheimdal-develUpgrade samba-clientUpgrade samba-winbind-libsUpgrade samba-ad-dc-libsUpgrade libheimbase1Upgrade samba-libs-64bitUpgrade krb5-miniUpgrade libwind0Upgrade samba-cephUpgrade samba-docUpgrade samba-ad-dc-libs-32bitUpgrade libsamba-policy-python3-develUpgrade samba-ldb-ldapUpgrade libkadm5srv8Upgrade samba-libs-python3Upgrade krb5-plugin-kdb-ldapUpgrade samba-winbind-libs-32bitUpgrade libhcrypto4Upgrade libsamba-policy0-python3-64bitUpgrade libheimedit0Upgrade libsamba-policy0-python3-32bitUpgrade libkadm5clnt7Upgrade libasn1-8Upgrade samba-devel-32bitUpgrade krb5-docUpgrade krb5-32bitUpgrade samba-testUpgrade libkafs0Upgrade samba-libsUpgrade krb5-plugin-preauth-otpUpgrade libsl0Upgrade krb5Upgrade samba-libs-python3-64bitUpgrade libhdb9Upgrade libgssapi3Upgrade krb5-devel-32bitUpgrade libsamba-policy0-python3Upgrade samba-client-libs-32bitUpgrade libhx509-5Upgrade samba-client-32bitUpgrade krb5-clientUpgrade libkrb5-26Upgrade krb5-plugin-preauth-spakeUpgrade krb5-develUpgrade ctdbUpgrade samba-libs-32bitUpgrade samba-client-libsUpgrade libkdc2Upgrade samba-develUpgrade samba-dsdb-modules | Nov 22, 2022 | Nov 21, 2022 |
| Ubuntu | — | Upgrade libkdb5-9Upgrade libgssapi-krb5-2 (Ubuntu Pro)Upgrade libgssapi-krb5-2Upgrade krb5-kdcUpgrade libkdb5-8 (Ubuntu Pro)Upgrade libgssapi3-heimdalUpgrade libkdb5-7 (Ubuntu Pro)Upgrade libhdb9-heimdalUpgrade krb5-kdc (Ubuntu Pro)Upgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade krb5-userUpgrade libhx509-5-heimdalUpgrade samba (Ubuntu Pro)Upgrade krb5-user (Ubuntu Pro)Upgrade libkdb5-10Upgrade krb5-admin-server (Ubuntu Pro)Upgrade krb5-admin-serverUpgrade sambaUpgrade libhdb9-heimdal (Ubuntu Pro)Upgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdal (Ubuntu Pro)Upgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade libkrb5-26-heimdalUpgrade libasn1-8-heimdal | Jan 13, 2023 | Nov 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub