In MIT Kerberos 5 (aka krb5) before 1.21.3 an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token causing the unwrapped token to appear truncated to the application.

🗓️ 05 Aug 2024 07:00:00Reported by MicrosoftType

Before Kerberos 1.21.3, an attacker can modify the plaintext Extra Count in a confidential wrap token to truncate the unwrapped token.

Reporter	Title	Published	Views	Family All 229
ibm	Security Bulletin: Multiple Vulnerabilities in IBM API Connect	15 Mar 202500:18	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	27 Sep 202422:50	–	ibm
ibm	Security Bulletin: Vulnerability in MIT Kerberos 5 (aka krb5) affects IBM watsonx Assistant for IBM Cloud Pak for Data	5 Feb 202514:52	–	ibm
ibm	Security Bulletin: IBM DataPower Gateway vulnerable to data truncation and DoS in Kerberos (CVE-2024-37370 & CVE-2024-37371)	3 Sep 202414:18	–	ibm
ibm	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Operator package issues	27 Sep 202422:45	–	ibm
ibm	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to GNOME GLib, libcurl and kerberos 5	27 Sep 202411:38	–	ibm
ibm	Security Bulletin: IBM MQ Operator and Queue manager container images are vulnerable to denial of service, privilege escalation and kerberos 5	6 Sep 202409:28	–	ibm
ibm	Security Bulletin: Multiple vulnerabilities in RedHat UBI affect IBM Robotic Process Automation for Cloud Pak	2 Dec 202416:09	–	ibm
ibm	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to plaintext token modification due to the krb5 package (CVE-2024-37370)	2 Sep 202514:23	–	ibm
ibm	Security Bulletin: Vulnerability in MIT Kerberos krb5 (CVE-2024-37370) affects Power HMC.	28 Jan 202522:08	–	ibm