Red Hat Security AdvisoryRHSA-2015:2154
krb5 security, bug fix, and enhancement update
Released 2015-11-19 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Client (v. 7) krb5-1.13.2-10.el7, krb5-libs-1.13.2-10.el7, krb5-pkinit-1.13.2-10.el7 +1
- Red Hat Enterprise Linux Client Optional (v. 7) krb5-devel-1.13.2-10.el7, krb5-server-1.13.2-10.el7, krb5-server-ldap-1.13.2-10.el7
- Red Hat Enterprise Linux ComputeNode (v. 7) krb5-1.13.2-10.el7, krb5-libs-1.13.2-10.el7, krb5-pkinit-1.13.2-10.el7 +1
- Red Hat Enterprise Linux ComputeNode Optional (v. 7) krb5-devel-1.13.2-10.el7, krb5-server-1.13.2-10.el7, krb5-server-ldap-1.13.2-10.el7
- Red Hat Enterprise Linux Server (v. 7) krb5-1.13.2-10.el7, krb5-devel-1.13.2-10.el7, krb5-devel-1.13.2-10.el7.ppc +6
- Red Hat Enterprise Linux Workstation (v. 7) krb5-1.13.2-10.el7, krb5-devel-1.13.2-10.el7, krb5-libs-1.13.2-10.el7 +4
Fixes 2 records
Priority LOW 31
The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote attackers to bypass an intended preauthenticati…
CVSS 2.0MEDIUM 5.8· Network · No auth · Interaction — · EPSS 0.02832 · Published 2015-05-25 · Fixed CWE-264
Priority LOW 30
MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote attackers to (1) cause a denial of service (NU…
CVSS 2.0MEDIUM 5.0· Network · No auth · Interaction — · EPSS 0.04587 · Published 2015-02-20 · Partial fix
