PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-pkinitUpgrade krb5-libsUpgrade libkadm5Upgrade krb5-workstationUpgrade krb5-server-ldapUpgrade krb5-develUpgrade krb5-server | Dec 6, 2022 | Nov 28, 2022 |
| Alpine Linux | — | Upgrade heimdalUpgrade sambaUpgrade krb5 | Mar 26, 2024 | Dec 25, 2022 |
| Amazon Linux Ami 2 | — | Upgrade krb5-serverUpgrade krb5-workstationUpgrade libkadm5Upgrade krb5-debuginfoUpgrade krb5-libsUpgrade krb5-server-ldapUpgrade krb5-develUpgrade krb5-pkinit | Jan 24, 2023 | Dec 25, 2022 |
| Amazon_linux | — | Upgrade krb5 | Jan 25, 2023 | Nov 5, 2022 |
| Arch Linux | — | Upgrade to the latest version of Arch Linux | Jul 11, 2025 | Dec 25, 2022 |
| Centos_linux | — | Upgrade krb5-workstation-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-develUpgrade krb5-pkinit-opensslUpgrade krb5-libs-debuginfoUpgrade krb5-pkinitUpgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade libkadm5Upgrade libkadm5-debuginfoUpgrade krb5-server-ldapUpgrade krb5-pkinit-debuginfoUpgrade krb5-debugsourceUpgrade krb5-workstationUpgrade krb5-libs | Nov 29, 2022 | Nov 28, 2022 |
| Debian | — | Upgrade heimdalUpgrade krb5Upgrade samba | Nov 21, 2022 | Nov 21, 2022 |
| Dell Powerstore Dsa2023173 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Jun 21, 2023 |
| Freebsd | — | Upgrade krb5Upgrade FreeBSDUpgrade mysql-connector-c++Upgrade mysql80-serverUpgrade krb5-119Upgrade mysql57-serverUpgrade mysql-connector-jUpgrade mysql-connector-odbcUpgrade krb5-120Upgrade krb5-devel | Nov 16, 2022 | Nov 15, 2022 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5.Upgrade net-fs/samba.Upgrade app-crypt/heimdal. | Sep 18, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp10 | — | Upgrade krb5Upgrade krb5-clientUpgrade krb5-serverUpgrade krb5-libs | Feb 13, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp11 | — | Upgrade samba-libsUpgrade samba-winbindUpgrade sambaUpgrade samba-common-toolsUpgrade libsmbclientUpgrade samba-clientUpgrade samba-winbind-modulesUpgrade samba-winbind-clientsUpgrade libwbclientUpgrade samba-common | Mar 8, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp5 | — | Upgrade samba-winbindUpgrade samba-client-libsUpgrade libwbclientUpgrade samba-pythonUpgrade sambaUpgrade samba-libsUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade samba-common-libsUpgrade samba-winbind-modulesUpgrade samba-common-toolsUpgrade libsmbclientUpgrade samba-common | Jun 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp8 | — | Upgrade samba-krb5-printingUpgrade ctdb-testsUpgrade samba-pidlUpgrade samba-testUpgrade samba-client-libsUpgrade samba-libsUpgrade libwbclientUpgrade python3-sambaUpgrade samba-winbind-krb5-locatorUpgrade samba-test-libsUpgrade samba-dc-libsUpgrade python3-samba-testUpgrade python2-samba-testUpgrade libsmbclientUpgrade python2-sambaUpgrade samba-winbind-modulesUpgrade samba-winbind-clientsUpgrade samba-clientUpgrade samba-common-libsUpgrade samba-winbindUpgrade samba-commonUpgrade sambaUpgrade samba-common-toolsUpgrade ctdb | Feb 9, 2023 | Dec 25, 2022 |
| Huawei Euleros 2_0_sp9 | — | Upgrade krb5-clientUpgrade krb5-serverUpgrade krb5-libsUpgrade krb5 | Jan 9, 2023 | Dec 25, 2022 |
| Nutanix Ahv | — | Upgrade Nutanix AHV to the latest version | Jun 5, 2026 | Apr 11, 2023 |
| Oracle_linux | — | Upgrade krb5-libsUpgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-pkinit-opensslUpgrade libkadm5Upgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-server-ldap | Nov 29, 2022 | Nov 15, 2022 |
| Redhat_linux | — | Upgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade libkadm5Upgrade libkadm5-debuginfoUpgrade krb5-debugsourceUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade krb5-libsUpgrade krb5-workstation-debuginfoUpgrade krb5-debuginfoUpgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-devel-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinit-debuginfo | Nov 29, 2022 | Nov 28, 2022 |
| Rocky_linux | — | Upgrade krb5-workstationUpgrade krb5-server-ldapUpgrade krb5-pkinit-debuginfoUpgrade krb5-debuginfoUpgrade krb5-devel-debuginfoUpgrade krb5-debugsourceUpgrade krb5-server-ldap-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-develUpgrade krb5-server-debuginfoUpgrade libkadm5-debuginfoUpgrade krb5-libsUpgrade krb5-libs-debuginfoUpgrade krb5-pkinitUpgrade krb5-serverUpgrade libkadm5 | Mar 12, 2024 | Dec 25, 2022 |
| Samba | — | Upgrade to Samba 4.17.3 or later.Upgrade to Samba 4.15.12 or later.Upgrade to Samba 4.16.7 or later. | Dec 25, 2022 | Dec 25, 2022 |
| Suse | — | Upgrade ctdbUpgrade samba-dsdb-modulesUpgrade libhx509-5Upgrade krb5-develUpgrade samba-libs-python3-64bitUpgrade samba-client-libsUpgrade krb5Upgrade libsamba-policy0-python3-32bitUpgrade libsamba-policy0-python3Upgrade krb5-plugin-preauth-spakeUpgrade krb5-clientUpgrade libheimedit0Upgrade libkadm5clnt7Upgrade samba-client-32bitUpgrade samba-testUpgrade samba-libsUpgrade krb5-plugin-preauth-otpUpgrade libhdb9Upgrade libgssapi3Upgrade krb5-devel-32bitUpgrade libsamba-policy0-python3-64bitUpgrade libkafs0Upgrade samba-client-libs-32bitUpgrade libsl0Upgrade samba-develUpgrade libkdc2Upgrade samba-libs-32bitUpgrade samba-devel-32bitUpgrade krb5-32bitUpgrade krb5-docUpgrade libasn1-8Upgrade libkrb5-26Upgrade libwind0Upgrade krb5-mini-develUpgrade samba-ad-dc-libs-32bitUpgrade libheimdal-develUpgrade krb5-plugin-preauth-pkinitUpgrade libsamba-policy-develUpgrade libroken18Upgrade ctdb-pcp-pmdaUpgrade samba-gpupdateUpgrade sambaUpgrade samba-docUpgrade samba-cephUpgrade krb5-miniUpgrade krb5-serverUpgrade samba-winbindUpgrade samba-python3Upgrade samba-ad-dc-libsUpgrade libotp0Upgrade samba-ldb-ldapUpgrade libkadm5srv8Upgrade libheimbase1Upgrade krb5-plugin-kdb-ldapUpgrade samba-libs-python3Upgrade libsamba-policy-python3-develUpgrade samba-libs-python3-32bitUpgrade samba-libs-64bitUpgrade samba-client-64bitUpgrade libhcrypto4Upgrade samba-winbind-libs-32bitUpgrade samba-clientUpgrade libheimntlm0Upgrade samba-ad-dcUpgrade samba-winbind-libsUpgrade samba-tool | Nov 22, 2022 | Nov 21, 2022 |
| Ubuntu | — | Upgrade libkdb5-7 (Ubuntu Pro)Upgrade libhx509-5-heimdalUpgrade krb5-kdc (Ubuntu Pro)Upgrade libgssapi3-heimdalUpgrade krb5-user (Ubuntu Pro)Upgrade samba (Ubuntu Pro)Upgrade libgssapi-krb5-2 (Ubuntu Pro)Upgrade libkdb5-9Upgrade libgssapi-krb5-2Upgrade libkrb5-26-heimdal (Ubuntu Pro)Upgrade libhdb9-heimdalUpgrade krb5-kdcUpgrade krb5-userUpgrade libkdb5-8 (Ubuntu Pro)Upgrade libkdb5-10Upgrade libkrb5-26-heimdalUpgrade krb5-admin-server (Ubuntu Pro)Upgrade sambaUpgrade krb5-admin-serverUpgrade libhdb9-heimdal (Ubuntu Pro)Upgrade libasn1-8-heimdalUpgrade libasn1-8-heimdal (Ubuntu Pro)Upgrade libhx509-5-heimdal (Ubuntu Pro)Upgrade libgssapi3-heimdal (Ubuntu Pro) | Jan 13, 2023 | Nov 5, 2022 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Dec 25, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub