kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade krb5-develUpgrade krb5-libsUpgrade krb5-workstationUpgrade krb5-pkinitUpgrade krb5-serverUpgrade libkadm5Upgrade krb5-server-ldap | Nov 16, 2023 | Aug 16, 2023 |
| Amazon_linux_2023 | — | Upgrade krb5-debugsourceUpgrade krb5-server-ldapUpgrade krb5-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-pkinitUpgrade krb5-libsUpgrade krb5-libs-debuginfoUpgrade krb5-workstationUpgrade krb5-develUpgrade libkadm5Upgrade krb5-serverUpgrade krb5-server-debuginfoUpgrade libkadm5-debuginfo | Feb 17, 2025 | Aug 16, 2023 |
| Centos_linux | — | Upgrade krb5-workstation-debuginfoUpgrade krb5-debuginfoUpgrade krb5-debugsourceUpgrade krb5-pkinit-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-server-ldapUpgrade krb5-workstationUpgrade krb5-develUpgrade krb5-server-debuginfoUpgrade krb5-serverUpgrade krb5-pkinitUpgrade libkadm5-debuginfoUpgrade krb5-libs-debuginfoUpgrade krb5-libsUpgrade libkadm5 | Nov 8, 2023 | Aug 16, 2023 |
| Freebsd | — | Upgrade krb5Upgrade krb5-121Upgrade krb5-devel | Dec 10, 2025 | Aug 14, 2023 |
| Gentoo Linux | — | Upgrade app-crypt/mit-krb5. | May 6, 2024 | Aug 16, 2023 |
| Oracle Mysql | — | Upgrade to MySQL version 8.2.0Upgrade to MySQL version 8.0.35 | Jun 15, 2026 | Aug 16, 2023 |
| Oracle_linux | — | Upgrade krb5-server-ldapUpgrade krb5-libsUpgrade krb5-pkinitUpgrade libkadm5Upgrade krb5-workstationUpgrade krb5-serverUpgrade krb5-devel | Nov 16, 2023 | Aug 16, 2023 |
| Redhat_linux | — | Upgrade libkadm5Upgrade libkadm5-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-workstationUpgrade krb5-server-ldapUpgrade krb5-debugsourceUpgrade krb5-serverUpgrade krb5-libsUpgrade krb5-libs-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-server-ldap-debuginfoUpgrade krb5-develUpgrade krb5-debuginfoUpgrade krb5-pkinit | Nov 8, 2023 | Aug 16, 2023 |
| Rocky_linux | — | Upgrade libkadm5Upgrade krb5-libsUpgrade libkadm5-debuginfoUpgrade krb5-server-debuginfoUpgrade krb5-develUpgrade krb5-pkinitUpgrade krb5-serverUpgrade krb5-workstationUpgrade krb5-libs-debuginfoUpgrade krb5-server-ldapUpgrade krb5-server-ldap-debuginfoUpgrade krb5-pkinit-debuginfoUpgrade krb5-debuginfoUpgrade krb5-workstation-debuginfoUpgrade krb5-debugsource | Jun 1, 2026 | May 28, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub