Log in Start free

Vulnerability · Published Aug 7, 2023 · Assigned by mitre

CVE-2023-36054

Medium 6.5

In plain English

A medium-severity security flaw in the krb5-devel package (AlmaLinux). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.5Medium
Exploit odds (30 days)2.8%top 13.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:9krb5-devel1.21.1-1.el9ALSA-2023:6699
AlmaLinux:9krb5-libs1.21.1-1.el9ALSA-2023:6699
AlmaLinux:9krb5-pkinit1.21.1-1.el9ALSA-2023:6699
AlmaLinux:9krb5-server1.21.1-1.el9ALSA-2023:6699
AlmaLinux:9krb5-server-ldap1.21.1-1.el9ALSA-2023:6699
AlmaLinux:9krb5-workstation1.21.1-1.el9ALSA-2023:6699
AlmaLinux:9libkadm51.21.1-1.el9ALSA-2023:6699
Debian:12krb51.20.1-2+deb12u1DEBIAN-CVE-2023-36054
Debian:13krb51.20.1-3DEBIAN-CVE-2023-36054
Debian:14krb51.20.1-3DEBIAN-CVE-2023-36054
Rocky Linux:9krb50:1.21.1-10.el9_8RLSA-2023:6699
Ubuntu:22.04:LTSkrb51.19.2-2ubuntu0.3USN-6467-2
Ubuntu:22.04:LTSkrb51.19.2-2ubuntu0.3UBUNTU-CVE-2023-36054

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References