Unrated severityOSV Advisory· Published Dec 26, 2018· Updated Aug 5, 2024
CVE-2018-20217
CVE-2018-20217
Description
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
21- Range: <1.17
- osv-coords19 versionspkg:rpm/opensuse/krb5&distro=openSUSE%20Leap%2015.0pkg:rpm/opensuse/krb5&distro=openSUSE%20Tumbleweedpkg:rpm/opensuse/krb5-mini&distro=openSUSE%20Leap%2015.0pkg:rpm/suse/krb5&distro=SUSE%20Enterprise%20Storage%204pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP3pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Desktop%2012%20SP4pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP1-LTSSpkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-BCLpkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP2-LTSSpkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP3pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP4pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%2012-LTSSpkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP1pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP3pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP4pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP3pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Software%20Development%20Kit%2012%20SP4pkg:rpm/suse/krb5&distro=SUSE%20OpenStack%20Cloud%207
< 1.15.2-lp150.5.3.1+ 18 more
- (no CPE)range: < 1.15.2-lp150.5.3.1
- (no CPE)range: < 1.19.2-3.1
- (no CPE)range: < 1.15.2-lp150.5.3.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.1-38.13.2
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.1-38.13.2
- (no CPE)range: < 1.12.1-38.13.2
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
- (no CPE)range: < 1.12.5-40.31.1
Patches
Vulnerability mechanics
References
6- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2KNHELH4YHNT6H2ESJWX2UIDXLBNGB2O/mitrevendor-advisoryx_refsource_FEDORA
- krbdev.mit.edu/rt/Ticket/Display.htmlmitrex_refsource_CONFIRM
- github.com/krb5/krb5/commit/5e6d1796106df8ba6bc1973ee0917c170d929086mitrex_refsource_CONFIRM
- lists.debian.org/debian-lts-announce/2019/01/msg00020.htmlmitremailing-listx_refsource_MLIST
- lists.debian.org/debian-lts-announce/2021/09/msg00019.htmlmitremailing-listx_refsource_MLIST
- security.netapp.com/advisory/ntap-20190416-0006/mitrex_refsource_CONFIRM
News mentions
0No linked articles in our index yet.