CVE-2024-26461

2024-02-2900:00:00

ubuntu.com

cve-2024-26461

kerberos 5

memory leak vulnerability

k5sealv3.c

mdeslaur

unix

6.2 Medium

AI Score

Confidence

Low

0.0004 Low

EPSS

Percentile

9.1%

JSON

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in
/krb5/src/lib/gssapi/krb5/k5sealv3.c.

Notes

Author	Note
	Priority reason: memory leak only unlikely to be triggered
mdeslaur	per upstream: “The k5sealv3.c leak affects an encoding function, and happens on a bounds check which likely cannot be triggered with any choice of memory-valid API inputs. (The bounds check was itself introduced to quash a different static analysis defect.)”

OSVersionArchitecturePackageVersionFilename
ubuntu18.04noarchkrb5< anyUNKNOWN
ubuntu20.04noarchkrb5< anyUNKNOWN
ubuntu22.04noarchkrb5< anyUNKNOWN
ubuntu23.10noarchkrb5< anyUNKNOWN
ubuntu24.04noarchkrb5< anyUNKNOWN
ubuntu14.04noarchkrb5< anyUNKNOWN
ubuntu16.04noarchkrb5< anyUNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	18.04	noarch	krb5	< any	UNKNOWN
ubuntu	20.04	noarch	krb5	< any	UNKNOWN
ubuntu	22.04	noarch	krb5	< any	UNKNOWN
ubuntu	23.10	noarch	krb5	< any	UNKNOWN
ubuntu	24.04	noarch	krb5	< any	UNKNOWN
ubuntu	14.04	noarch	krb5	< any	UNKNOWN
ubuntu	16.04	noarch	krb5	< any	UNKNOWN