Red Hat Security AdvisoryRHSA-2023:6699
krb5 security and bug fix update
Released 2023-11-07 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux AppStream (v. 9) krb5-devel-1.21.1-1.el9
- Red Hat Enterprise Linux BaseOS (v. 9) krb5-1.21.1-1.el9, krb5-libs-1.21.1-1.el9, krb5-pkinit-1.21.1-1.el9 +4
Fixes 2 records
Priority MEDIUM 43
kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.01468 · Published 2023-08-16 · Fixed CWE-415
Priority LOW 34
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.02814 · Published 2023-08-07 · Partial fix CWE-824
