EulerOS 2.0 SP9 : krb5 (EulerOS-SA-2024-2395)

According to the versions of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : In MIT Kerberos 5 aka krb5 before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the...

USN-6947-1: Kerberos vulnerabilities

It was discovered that Kerberos incorrectly handled GSS message tokens where an unwrapped token could appear to be truncated. An attacker could possibly use this issue to cause a denial of service. CVE-2024-37370 It was discovered that Kerberos incorrectly handled GSS message tokens when sent a...

USN-6947-1 krb5 vulnerabilities

It was discovered that Kerberos incorrectly handled GSS message tokens where an unwrapped token could appear to be truncated. An attacker could possibly use this issue to cause a denial of service. CVE-2024-37370 It was discovered that Kerberos incorrectly handled GSS message tokens when sent a...

SUSE-SU-2024:2307-1 Security update for krb5

This update for krb5 fixes the following issues: - CVE-2024-37370: Fixed confidential GSS krb5 wrap tokens with invalid fields were errouneously accepted bsc1227186. - CVE-2024-37371: Fixed invalid memory read when processing message tokens with invalid length fields bsc1227187...

SUSE-SU-2024:2302-1 Security update for krb5

This update for krb5 fixes the following issues: - CVE-2024-37370: Fixed confidential GSS krb5 wrap tokens with invalid fields were errouneously accepted bsc1227186. - CVE-2024-37371: Fixed invalid memory read when processing message tokens with invalid length fields bsc1227187...

Denial Of Service (DoS)

MIT Kerberos 5 is vulnerable to Denial Of Service DoS. The vulnerability is due to insufficient validation of length fields in message tokens, allowing an attacker to cause invalid memory reads by sending tokens with invalid length values...

PT-2024-6097

Name of the Vulnerable Software and Affected Versions: MIT Kerberos 5 versions prior to 1.21.3 Description: The issue is related to the handling of GSS message tokens in the Kerberos authentication protocol. An attacker can cause invalid memory reads by sending message tokens with invalid length...