Oracle Linux 8 : krb5 (ELSA-2024-5312)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2024-5312 advisory. 1.18.2-29.0.1 - Fixed race condition in krb5setpassword Orabug: 33609767 1.18.2-29 - CVE-2024-37370 CVE-2024-37371 Fix vulnerabilities in GSS message...

RHEL 7 : krb5 (RHSA-2024:5316)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:5316 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending...

Moderate: Red Hat Security Advisory: krb5 security update

An update for krb5 is now available for Red Hat Enterprise Linux 7.7 Advanced Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

Moderate: Red Hat Security Advisory: krb5 security update

An update for krb5 is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

kernel: SUNRPC: fix a memleak in gss_import_v2_context

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gssimportv2context The ctx-mechused.data allocated by kmemdup is not freed in neither gssimportv2context nor it only caller gsskrb5importseccontext, which frees ctx on error. Thus, this patch reform the...

kernel: SUNRPC: fix a memleak in gss_import_v2_context

In the Linux kernel, the following vulnerability has been resolved: SUNRPC: fix a memleak in gssimportv2context The ctx-mechused.data allocated by kmemdup is not freed in neither gssimportv2context nor it only caller gsskrb5importseccontext, which frees ctx on error. Thus, this patch reform the...

USN-6947-1: Kerberos vulnerabilities

It was discovered that Kerberos incorrectly handled GSS message tokens where an unwrapped token could appear to be truncated. An attacker could possibly use this issue to cause a denial of service. CVE-2024-37370 It was discovered that Kerberos incorrectly handled GSS message tokens when sent a...

The vulnerability of the gss_read_proxy_verf() function in the implementation of the Remote Procedure Call (RPC) protocol in the Linux operating system allows a hacker to cause a service failure.

The vulnerability of the gssreadproxyverf function in the net/sunrpc/authgss/svcauthgss.c module, which is part of the Linux kernel’s Remote Procedure Call RPC implementation, is related to insufficient memory allocation for this operation. Exploiting this vulnerability could allow an attacker to...

CBL Mariner 2.0 Security Update: krb5 (CVE-2024-37371)

The version of krb5 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-37371 advisory. - In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token...

Amazon Linux 2023 : krb5-devel, krb5-libs, krb5-pkinit (ALAS2023-2024-688)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2024-688 advisory. krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens...

CBL Mariner 2.0 Security Update: krb5 (CVE-2024-37370)

The version of krb5 installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-37370 advisory. - In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can modify the plaintext Extra Count field of a...

In MIT Kerberos 5 (aka krb5) before 1.21.3 an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

...

Amazon Linux 2 : krb5 (ALAS-2024-2595)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2024-2595 advisory. krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens wi...

RHEL 8 : krb5 (RHSA-2024:4734)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:4734 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending...

Medium: krb5

Issue Overview: krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. CVE-2024-37371 Affected Packages: krb5 Note: This advisory i...

Medium: krb5

Issue Overview: krb5: GSS message token handling CVE-2024-37370 In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. CVE-2024-37371 Affected Packages: krb5 Note: This advisory i...

Fedora 39 : krb5 (2024-df2c70dba9)

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-df2c70dba9 advisory. This update fixes multiple CVEs and rebases to the latest upstream version: Tue Jul 09 2024 Julien Rische - 1.21.3-1 - New upstream version 1.21.3 -...

Fedora 40 : krb5 (2024-1f68985052)

The remote Fedora 40 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2024-1f68985052 advisory. This update fixes multiple CVEs and rebases to the latest upstream version: Tue Jul 09 2024 Julien Rische - 1.21.3-1 - New upstream version 1.21.3 -...

openSUSE: Security Advisory for krb5 (SUSE-SU-2024:2303-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian dsa-5726 : krb5-admin-server - security update

The remote Debian 11 / 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-5726 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-5726-1 [email protected]...