CVE-2023-39975

CVE-2023-39975 affects MIT Kerberos 5 (krb5) 1.21 and earlier up to 1.21.1. The issue is a double free in KDC TGS processing (kdc/do_tgs_req.c) that is reachable when an authenticated user triggers an authorization-data handling failure, causing improper data copying between tickets and resulting...

FreeBSD : krb5 -- Double-free in KDC TGS processing (a6986f0f-3ac0-11ee-9a88-206a8a720317)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the a6986f0f-3ac0-11ee-9a88-206a8a720317 advisory. - This is a backport of the upstream fix for CVE-2023-39975: https://github.com/krb5/krb5/pull/1312...

Fedora 38 : krb5 (2023-ca086f015c)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-ca086f015c advisory. This is a backport of the upstream fix for CVE-2023-39975: https://github.com/krb5/krb5/pull/1312 Tenable has extracted the preceding description block...

Fedora: Security Advisory for krb5 (FEDORA-2023-ca086f015c)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

AlmaLinux 8 : curl (ALSA-2023:4523)

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2023:4523 advisory. - An authentication bypass vulnerability exists libcurl 8.0.0 in the connection reuse feature which can reuse previously established connections with...

CVE-2023-36054

lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because xdrkadm5principalentrec does not validate the relationship between nkeydata and the keydata array...

CVE-2023-36054

lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because xdrkadm5principalentrec does not validate the relationship between nkeydata and the keydata array...

krb5 -- Double-free in KDC TGS processing

The MIT krb5 Team reports: When issuing a ticket for a TGS renew or validate request, copy only the server field from the outer part of the header ticket to the new ticket. Copying the whole structure causes the encpart pointer to be aliased to the header ticket until krb5encrypttktpart is called...

Important Photon OS Security Update - PHSA-2023-4.0-0442

Updates of 'ostree' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2023-5.0-0062

Updates of 'krb5' packages of Photon OS have been released...

Moderate Photon OS Security Update - PHSA-2023-3.0-0624

Updates of 'krb5' packages of Photon OS have been released...

EulerOS Virtualization 3.0.6.6 : krb5 (EulerOS-SA-2023-2426)

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - PAC parsing in MIT Kerberos 5 aka krb5 before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code...

Huawei EulerOS: Security Advisory for krb5 (EulerOS-SA-2023-2426)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Slackware: Security Advisory (SSA:2023-193-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] krb5

New krb5 packages are available for Slackware 15.0 and -current to fix a security issue. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/krb5-1.19.2-i586-4slack15.0.txz: Rebuilt. Fix potential uninitialized pointer free in kadm5 XDR parsing. For more information, see:...

Slackware Linux 15.0 / current krb5 Vulnerability (SSA:2023-193-01)

The version of krb5 installed on the remote host is prior to 1.19.2 / 1.21.1. It is, therefore, affected by a vulnerability as referenced in the SSA:2023-193-01 advisory. - lib/kadm5/kadmrpcxdr.c in MIT Kerberos 5 aka krb5 before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A...

Important: Red Hat Enhancement Advisory: krb5 bug fix update

An update for krb5 is now available for Red Hat Enterprise Linux 8. Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to...

krb5 bug fix update

An update is available for krb5. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list Kerberos is a network authentication system, which can improve the security of...

PT-2023-4089 · Pam Krb5 +2 · Pam Krb5 +2

Name of the Vulnerable Software and Affected Versions: pam krb5 affected versions not specified Description: The issue is related to the incorrect implementation of the authentication algorithm in the pam krb5 module. This allows an attacker to gain unauthorized access to the system by controllin...

EulerOS Virtualization 3.0.6.0 : krb5 (EulerOS-SA-2023-2222)

According to the versions of the krb5 packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - PAC parsing in MIT Kerberos 5 aka krb5 before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code...