rpm package
suse/krb5-appl&distro=SUSE OpenStack Cloud 9
pkg:rpm/suse/krb5-appl&distro=SUSE%20OpenStack%20Cloud%209
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-39028 | — | < 1.0.3-3.9.1 | 1.0.3-3.9.1 | Aug 30, 2022 | telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However, | ||
| CVE-2019-25017 | — | < 1.0.3-3.6.1 | 1.0.3-3.6.1 | Feb 2, 2021 | An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only | ||
| CVE-2019-25018 | — | < 1.0.3-3.6.1 | 1.0.3-3.6.1 | Feb 2, 2021 | In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client sid |
- CVE-2022-39028Aug 30, 2022affected < 1.0.3-3.9.1fixed 1.0.3-3.9.1
telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash but the telnet service would remain available through inetd. However,
- CVE-2019-25017Feb 2, 2021affected < 1.0.3-3.6.1fixed 1.0.3-3.6.1
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only
- CVE-2019-25018Feb 2, 2021affected < 1.0.3-3.6.1fixed 1.0.3-3.6.1
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client sid