rpm package
suse/krb5&distro=SUSE Linux Enterprise Server for SAP Applications 12 SP2
pkg:rpm/suse/krb5&distro=SUSE%20Linux%20Enterprise%20Server%20for%20SAP%20Applications%2012%20SP2
Vulnerabilities (6)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2020-28196 | — | < 1.12.5-40.40.2 | 1.12.5-40.40.2 | Nov 6, 2020 | MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit. | ||
| CVE-2018-20217 | — | < 1.12.5-40.31.1 | 1.12.5-40.31.1 | Dec 26, 2018 | A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request. | ||
| CVE-2018-5730 | — | < 1.12.5-40.23.2 | 1.12.5-40.23.2 | Mar 6, 2018 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a | ||
| CVE-2018-5729 | — | < 1.12.5-40.23.2 | 1.12.5-40.23.2 | Mar 6, 2018 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. | ||
| CVE-2017-15088 | Cri | 9.8 | < 1.12.5-40.16.1 | 1.12.5-40.16.1 | Nov 23, 2017 | plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involvi | |
| CVE-2017-11462 | Cri | 9.8 | < 1.12.5-40.13.1 | 1.12.5-40.13.1 | Sep 13, 2017 | Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error. |
- CVE-2020-28196Nov 6, 2020affected < 1.12.5-40.40.2fixed 1.12.5-40.40.2
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
- CVE-2018-20217Dec 26, 2018affected < 1.12.5-40.31.1fixed 1.12.5-40.31.1
A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.
- CVE-2018-5730Mar 6, 2018affected < 1.12.5-40.23.2fixed 1.12.5-40.23.2
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a
- CVE-2018-5729Mar 6, 2018affected < 1.12.5-40.23.2fixed 1.12.5-40.23.2
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.
- affected < 1.12.5-40.16.1fixed 1.12.5-40.16.1
plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involvi
- affected < 1.12.5-40.13.1fixed 1.12.5-40.13.1
Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.