CVE-2017-7562

An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances...

Security Bulletin: Vulnerabilities in MIT Kerberos 5 (krb5) affect PowerKVM (CVE-2014-5355, CVE-2015-2694)

Summary PowerKVM is affected by two vulnerabilities in MIT Kerberos 5 krb5. These vulnerabilities are now fixed. Vulnerability Details CVEID: CVE-2014-5355 DESCRIPTION: MIT Kerberos is vulnerable to a denial of service, caused by a NULL pointer dereference in the krb5recvauth function. By sending...

Security Bulletin: Multiple Kerberos (krb5) vulnerabilities affect PowerKVM (Multiple CVEs)

Summary PowerKVM is affected by several vulnerabilities in Kerberos krb5. Vulnerability Details CVEID: CVE-2014-5352 DESCRIPTION: MIT krb5 could allow a remote authenticated attacker to execute arbitrary code on the system,, caused by a double-free error in gssprocesscontexttoken. An attacker cou...

Security Bulletin: Multiple vulnerabilities in unzip, krb5, tomcat, affect IBM SmartCloud Provisioning for IBM Software Virtual Appliance

Summary Multiple vulnerabilities in unzip, krb5, tomcat, affect IBM SmartCloud Provisioning 2.1 for IBM Software Virtual Appliance CVE-2014-8139, CVE-2014-8140, CVE-2014-8141, CVE-2014-9636, CVE-2014-5355, CVE-2014-9421, CVE-2014-5352, CVE-2014-5353, CVE-2014-9422, CVE-2014-0227. Vulnerability...

Security Bulletin: Vulnerabilities in Kerberos (krb5) affect IBM Security Network Protection (CVE-2015-8629, and CVE-2015-8631)

Summary IBM Security Network Protection uses Kerberos krb5 to provide network authentication. The Kerberos krb5 version that is shipped with IBM Security Network Protection contains multiple security vulnerabilities. Vulnerability Details CVEID: CVE-2015-8629 DESCRIPTION: MIT Kerberos could allow...

Security Bulletin: Vulnerabilities in Kerberos (krb5) affect IBM Security Network Protection (CVE-2014-5352, CVE-2014-5353, CVE-2014-5355, CVE-2014-9421, and CVE-2014-9422)

Summary IBM Security Network Protection uses Kerberos krb5 to provide network authentication. The Kerberos krb5 version that is shipped with IBM Security Network Protection contains multiple security vulnerabilities. Vulnerability Details CVE-ID: CVE-2014-5352 Description: MIT krb5 could allow a...

[ASA-201806-3] krb5: insufficient validation

Arch Linux Security Advisory ASA-201806-3 ========================================= Severity: Medium Date : 2018-06-05 CVE-ID : CVE-2018-5729 CVE-2018-5730 Package : krb5 Type : insufficient validation Remote : Yes Link : https://security.archlinux.org/AVG-586 Summary ======= The package krb5...

SUSE SLES12 Security Update : krb5 (SUSE-SU-2018:1425-1)

This update for krb5 provides the following fixes: Security issues fixed : - CVE-2017-7562: Improper validation of certificate EKU and SAN could lead to authentication bypass. bsc1055851 Non-security issues fixed : - Set 'rdns' and 'dnscanonicalizehostname' to false in krb5.conf in order to impro...

Integer Overflow

krb5 is vulnerable to integer overflow. Storing 32-bit variable data into the 16-bit variable dbentry-nkeydata in kadmin/dbutil/dump leads to integer overflow...

SUSE-SU-2018:1425-1 Security update for krb5

This update for krb5 provides the following fixes: Security issues fixed: - CVE-2017-7562: Improper validation of certificate EKU and SAN could lead to authentication bypass. bsc1055851 Non-security issues fixed: - Set 'rdns' and 'dnscanonicalizehostname' to false in krb5.conf in order to improve...

Amazon Linux 2 : krb5 (ALAS-2018-1010)

Authentication bypass by improper validation of certificate EKU and SAN An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate...

Medium: krb5

Issue Overview: Authentication bypass by improper validation of certificate EKU and SAN An authentication bypass flaw was found in the way krb5's certauth interface handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to...

Security fix for the ALT Linux 8 package krb5 version 1.14.6-alt1.M80P.1

1.14.6-alt1.M80P.1 built May 3, 2018 Evgeny Sinelnikov in task 204403 April 17, 2018 Evgeny Sinelnikov - Update to latest security release of krb5-1.14 - Security fixes: + CVE-2017-11368 Fix a KDC denial of service vulnerability caused by unset status strings + CVE-2017-11462 Preserve GSS context...

Scientific Linux Security Update : krb5 on SL7.x x86_64 (20180410)

Security Fixes : - krb5: Authentication bypass by improper validation of certificate EKU and SAN CVE-2017-7562 - krb5: Invalid S4U2Self or S4U2Proxy request causes assertion failure CVE-2017-11368 Additional Changes : C Tenable Network Security, Inc. The descriptive text is C Scientific Linux...

CentOS 7 : krb5 (CESA-2018:0666)

An update for krb5 is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...

Oracle Linux 7 : krb5 (ELSA-2018-0666)

The remote Oracle Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2018-0666 advisory. - Fix CVE-2017-7562 certauth eku bypass - Fix CVE-2017-11368 s4u2 request assertion failures Tenable has extracted the preceding description block...

krb5 security, bug fix, and enhancement update

1.15.1-18 - Expose context errors in pkinitserverplugininit - Resolves: 1460089 1.15.1-17 - Drop certauth test changes that prevented runnig it - Resolves: 1498767 1.15.1-16 - Drop irrelevant DIR trigger logic - Resolves: 1431198 1.15.1-15 - Fix CVE-2017-7562 certauth eku bypass - Resolves: 14987...

RHEL 7 : krb5 (RHSA-2018:0666)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2018:0666 advisory. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending...

SUSE SLES11 Security Update : krb5 (SUSE-SU-2018:0859-1)

This update for krb5 fixes several issues. This security issue was fixed : - CVE-2017-11462: Prevent automatic security context deletion to prevent double-free bsc1056995. - CVE-2018-5729: NULL pointer dereference in kadmind or DN container check bypass by supplying special crafted data bsc108392...

SUSE-SU-2018:0859-1 Security update for krb5

This update for krb5 fixes several issues. This security issue was fixed: - CVE-2017-11462: Prevent automatic security context deletion to prevent double-free bsc1056995. - CVE-2018-5729: Null pointer dereference in kadmind or DN container check bypass by supplying special crafted data bsc1083926...