The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that lacks a server field.

🗓️ 15 Oct 2021 07:00:00Reported by MicrosoftType

MIT Kerberos KDC has a null pointer dereference in kdc/do_tgs_req.c caused by a FAST inner body missing a server field, affecting older versions.

Reporter	Title	Published	Views	Family All 148
ALT Linux	Security fix for the ALT Linux 9 package krb5 version 1.17.2-alt3	21 Mar 202200:00	–	altlinux
ALT Linux	Security fix for the ALT Linux 10 package krb5 version 1.19.3-alt1	18 Mar 202200:00	–	altlinux
IBM Security Bulletins	Security Bulletin: IBM QRadar Network Packet Capture is using components with known vulnerabilities	31 Mar 202214:40	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in MIT Kerberos 5 affects PowerSC (CVE-2021-37750)	15 Sep 202215:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in go.etcd.io/etcd package affects IBM Watson Machine Learning Accelerator on Cloud Pak for Data	6 Dec 202316:17	–	ibm
ATTACKERKB	CVE-2021-37750	23 Aug 202105:15	–	attackerkb
Amazon	Medium: krb5	20 Jan 202200:00	–	amazon
Tenable Nessus	Alibaba Cloud Linux 3 : 0068: krb5 (ALINUX3-SA-2021:0068)	14 May 202500:00	–	nessus
Tenable Nessus	AlmaLinux 8 : krb5 (ALSA-2021:3576)	9 Feb 202200:00	–	nessus
Tenable Nessus	CentOS 8 : krb5 (CESA-2021:3576)	23 Sep 202100:00	–	nessus