CVE-2024-37370

2024-06-2822:15:02

Alpine Linux Development Team

security.alpinelinux.org

mit kerberos 5

plaintext

gss krb5 wrap

token

truncated

application

unix

7.2 High

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.2%

JSON

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

OSVersionArchitecturePackageVersionFilename
Alpineedge-mainnoarchkrb5< 1.20.3-r0UNKNOWN
Alpine3.19-mainnoarchkrb5< 1.20.3-r0UNKNOWN
Alpine3.20-mainnoarchkrb5< 1.20.3-r0UNKNOWN