lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
CVSS Details
- CVSS 3.1 Base Score: 6.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-serverUpgrade libkadm5Upgrade krb5-workstationUpgrade krb5-develUpgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-pkinit | Nov 16, 2023 | Aug 7, 2023 |
| Alpine Linux | — | Upgrade krb5 | Aug 22, 2024 | Aug 7, 2023 |
| Amazon Linux Ami 2 | — | Upgrade krb5-pkinitUpgrade krb5-libsUpgrade krb5-debuginfoUpgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-workstationUpgrade krb5-serverUpgrade krb5-devel | Sep 8, 2023 | Aug 7, 2023 |
| Amazon_linux | — | Upgrade krb5 | Sep 11, 2023 | Aug 7, 2023 |
| Amazon_linux_2023 | — | Upgrade krb5-serverUpgrade krb5-debuginfoUpgrade krb5-workstationUpgrade krb5-pkinitUpgrade libkadm5Upgrade krb5-libs-debuginfoUpgrade krb5-develUpgrade krb5-server-debuginfoUpgrade libkadm5-debuginfoUpgrade krb5-debugsourceUpgrade krb5-libsUpgrade krb5-server-ldap-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldap | Feb 17, 2025 | Aug 7, 2023 |
| Centos_linux | — | Upgrade krb5-workstation-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinitUpgrade krb5-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-workstationUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-develUpgrade libkadm5-debuginfoUpgrade krb5-libsUpgrade krb5-server-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-server-ldapUpgrade krb5-debugsource | Nov 8, 2023 | Aug 7, 2023 |
| Debian | — | Upgrade krb5 | Oct 24, 2023 | Aug 7, 2023 |
| Dell Powerstore Dsa2024120 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | Mar 26, 2024 |
| Dell Powerstore Dsa2024158 | — | Upgrade Dell PowerStoreOS to the latest version | Jan 13, 2026 | Apr 4, 2024 |
| Dell Powerstore Dsa2024225 | — | Upgrade Dell PowerStoreOS to the latest version | Oct 23, 2025 | May 29, 2024 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | May 6, 2024 | Aug 7, 2023 |
| Huawei Euleros 2_0_sp10 | — | Upgrade krb5-clientUpgrade krb5-libsUpgrade krb5Upgrade krb5-server | Jan 10, 2024 | Aug 7, 2023 |
| Huawei Euleros 2_0_sp11 | — | Upgrade krb5-libsUpgrade krb5-clientUpgrade krb5-serverUpgrade krb5 | Jan 10, 2024 | Aug 7, 2023 |
| Huawei Euleros 2_0_sp5 | — | Upgrade krb5-libsUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-workstationUpgrade krb5-develUpgrade krb5-server-ldapUpgrade krb5-pkinit | Feb 12, 2024 | Aug 7, 2023 |
| Huawei Euleros 2_0_sp8 | — | Upgrade krb5-serverUpgrade krb5-pkinitUpgrade krb5-libsUpgrade krb5-develUpgrade libkadm5Upgrade krb5-server-ldapUpgrade krb5-workstation | Jan 10, 2024 | Aug 7, 2023 |
| Huawei Euleros 2_0_sp9 | — | Upgrade krb5-serverUpgrade krb5-clientUpgrade krb5Upgrade krb5-libs | Jan 10, 2024 | Aug 7, 2023 |
| Oracle_linux | — | Upgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-pkinitUpgrade krb5-libsUpgrade krb5-develUpgrade libkadm5Upgrade krb5-server-ldap | Nov 16, 2023 | Aug 7, 2023 |
| Redhat_linux | — | Upgrade krb5-workstationUpgrade krb5-server-debuginfoUpgrade krb5-libsUpgrade libkadm5-debuginfoUpgrade krb5-serverUpgrade krb5-server-ldapUpgrade libkadm5Upgrade krb5-debugsourceUpgrade krb5-libs-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-develUpgrade krb5-pkinit-debuginfoUpgrade krb5-debuginfoUpgrade krb5-pkinit | Nov 8, 2023 | Aug 7, 2023 |
| Rocky_linux | — | Upgrade krb5-serverUpgrade krb5-pkinit-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-libsUpgrade krb5-workstation-debuginfoUpgrade krb5-pkinitUpgrade krb5-server-ldapUpgrade libkadm5Upgrade libkadm5-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-debugsourceUpgrade krb5-workstationUpgrade krb5-develUpgrade krb5-debuginfo | Jun 1, 2026 | May 28, 2026 |
| Suse | — | Upgrade krb5-clientUpgrade krb5-devel-32bitUpgrade krb5-develUpgrade krb5-plugin-preauth-spakeUpgrade krb5-plugin-preauth-otpUpgrade krb5-plugin-kdb-ldapUpgrade krb5-serverUpgrade krb5-docUpgrade krb5-plugin-preauth-pkinitUpgrade krb5-32bitUpgrade krb5 | Aug 17, 2023 | Aug 7, 2023 |
| Ubuntu | — | Upgrade libk5crypto3 (Ubuntu Pro)Upgrade krb5-admin-server (Ubuntu Pro)Upgrade krb5-user (Ubuntu Pro)Upgrade libkdb5-9Upgrade krb5-kdcUpgrade libkadm5srv-mit11Upgrade libkrad0Upgrade libkdb5-8 (Ubuntu Pro)Upgrade libkadm5srv-mit11 (Ubuntu Pro)Upgrade krb5-kdc-ldap (Ubuntu Pro)Upgrade krb5-admin-serverUpgrade libkdb5-9 (Ubuntu Pro)Upgrade krb5-kdc (Ubuntu Pro)Upgrade libkadm5clnt-mit9 (Ubuntu Pro)Upgrade krb5-pkinitUpgrade krb5-userUpgrade libkadm5srv-mit9 (Ubuntu Pro)Upgrade libgssapi-krb5-2 (Ubuntu Pro)Upgrade krb5-otp (Ubuntu Pro)Upgrade libkdb5-7 (Ubuntu Pro)Upgrade libkadm5clnt-mit11 (Ubuntu Pro)Upgrade krb5-pkinit (Ubuntu Pro)Upgrade libkrb5support0 (Ubuntu Pro)Upgrade libk5crypto3Upgrade libkdb5-10Upgrade libgssapi-krb5-2Upgrade libkadm5srv-mit8 (Ubuntu Pro)Upgrade libgssrpc4Upgrade krb5-kdc-ldapUpgrade libkrb5-3Upgrade libgssrpc4 (Ubuntu Pro)Upgrade krb5-otpUpgrade libkrad0 (Ubuntu Pro)Upgrade libkrb5-3 (Ubuntu Pro)Upgrade libkadm5clnt-mit12Upgrade libkrb5support0Upgrade libkadm5srv-mit12Upgrade libkadm5clnt-mit11 | Nov 2, 2023 | Aug 7, 2023 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | Aug 7, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub