rpm package
opensuse/krb5&distro=openSUSE Leap 15.0
pkg:rpm/opensuse/krb5&distro=openSUSE%20Leap%2015.0
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2018-20217 | — | < 1.15.2-lp150.5.3.1 | 1.15.2-lp150.5.3.1 | Dec 26, 2018 | A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request. | ||
| CVE-2018-5730 | — | < 1.15.2-lp150.5.6.1 | 1.15.2-lp150.5.6.1 | Mar 6, 2018 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a | ||
| CVE-2018-5729 | — | < 1.15.2-lp150.5.6.1 | 1.15.2-lp150.5.6.1 | Mar 6, 2018 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. |
- CVE-2018-20217Dec 26, 2018affected < 1.15.2-lp150.5.3.1fixed 1.15.2-lp150.5.3.1
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
- CVE-2018-5730Mar 6, 2018affected < 1.15.2-lp150.5.6.1fixed 1.15.2-lp150.5.6.1
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a
- CVE-2018-5729Mar 6, 2018affected < 1.15.2-lp150.5.6.1fixed 1.15.2-lp150.5.6.1
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.