CVE-2024-37371

2024-06-2823:15:11

[email protected]

web.nvd.nist.gov

mit kerberos

memory reads

gss message

6.9 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

9.1%

JSON

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

References

github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef

web.mit.edu/kerberos/www/advisories/