CVE-2019-12098: In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack

High severity · published May 15, 2019

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack

7.4

CVSS

EPSS

On KEV

Description

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack vector

Network

Complexity

High

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)2.0% · higher than 80% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Backports Sle · Opensuse

15.0; 15.0 · source: NVD

Debian Linux · Debian

9.0 · source: NVD

Fedora · Fedoraproject

30; 31 · source: NVD

Heimdal · Heimdal Project

before 7.6.0 · source: NVD

Leap · Opensuse

15.0; 15.1; 42.3 · source: NVD

Affected product

Debian Linux

Debian

All Debian Linux CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-12098

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-12098

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.html

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.html

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html

Patch

http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html

Patch

https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf

Patch

https://github.com/heimdal/heimdal/compare/3e58559...bbafe72