CVE-2018-5730

MIT krb5 1.6 or later allows an authenticated kadmin with permission to add
principals to an LDAP Kerberos database to circumvent a DN containership
check by supplying both a “linkdn” and “containerdn” database argument, or
by supplying a DN string which is a left extension of a container DN string
but is not hierarchically within the container DN.

Bugs

• <http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=891869&gt;