K5
Product
Kerberos 5
139
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 12Medium 13Low 3
Watch
Add Kerberos 5 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-15088 | 9.8 | Nov 23 | plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute… Affected: through 1.15.2 |
| CVE-2017-11462 | 9.8 | Sep 13 | Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error Affected: 1.14; 1.14; 1.14; 1.14; 1.14.1; 1.14.2; +7 more |
| CVE-2008-0062 | 9.8 | Mar 19 | KDC in MIT Kerberos 5 (krb5kdc) does not set a global variable for some krb4 message types, which allows remote attackers to cause a denial of service (crash) and possibly execute… Affected: through 1.6.3 |
| CVE-2005-1689 | 9.8 | Jul 18 | Double free vulnerability in the krb5_recvauth function in MIT Kerberos 5 (krb5) 1.4.1 and earlier allows remote attackers to execute arbitrary code via certain error conditions Affected: through 1.4.1 |
| CVE-2004-0772 | 9.8 | Oct 20 | Double free vulnerabilities in error handling code in krb524d for MIT Kerberos 5 (krb5) 1.2.8 and earlier may allow remote attackers to execute arbitrary code Affected: through 1.2.8 |
| CVE-2024-37371 | 9.1 | Jun 28 | In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields Affected: before 1.21.3 |
| CVE-2023-39975 | 8.8 | Aug 16 | kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure Affected: 1.21 before 1.21.2 |
| CVE-2022-42898 | 8.8 | Dec 25 | PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos… Affected: 1.8 before 1.19.4; 1.20; 1.20 |
| CVE-2026-40356 | 7.5 | Apr 28 | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a… Affected: 1.18 before 1.22.3 |
| CVE-2026-40355 | 7.5 | Apr 28 | In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in… Affected: 1.18 before 1.22.3 |
| CVE-2024-37370 | 7.5 | Jun 28 | In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear… Affected: before 1.21.3 |
| CVE-2024-26461 | 7.5 | Feb 29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c Affected: 1.21.2 |
| CVE-2022-39028 | 7.5 | Aug 30 | telnetd in GNU Inetutils through 2.3, MIT krb5-appl through 1.0.3, and derivative works has a NULL pointer dereference via 0xff 0xf7 or 0xff 0xf8 Affected: through 1.0.3 |
| CVE-2021-36222 | 7.5 | Jul 22 | ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL… Affected: before 1.18.4; 1.19.0 before 1.19.2 |
| CVE-2020-28196 | 7.5 | Nov 6 | MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support… Affected: before 1.17.2; 1.18.0 before 1.18.3 |
| CVE-2019-14844 | 7.5 | Sep 26 | A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could crash the KDC by sending one of the RFC 4556 "enctypes" Affected: 1.16.1 through 1.17.1 |
| CVE-2015-8630 | 7.5 | Feb 13 | The (1) kadm5_create_principal_3 and (2) kadm5_modify_principal functions in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.4… Affected: 1.12; 1.12.1; 1.12.2; 1.12.3; 1.12.4; 1.12.5; +8 more |
| CVE-2008-0063 | 7.5 | Mar 19 | The Kerberos 4 support in KDC in MIT Kerberos 5 (krb5kdc) does not properly clear the unused portion of a buffer when generating an error message, which might allow remote… Affected: through 1.6.3 |
| CVE-2023-36054 | 6.5 | Aug 7 | lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer Affected: before 1.20.2; 1.21; 1.21 |
| CVE-2021-37750 | 6.5 | Aug 23 | The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that… Affected: before 1.18.5; 1.19.0 before 1.19.3 |
| CVE-2017-7562 | 6.5 | Jul 26 | An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates Affected: 1.0 before 1.16.1 |
| CVE-2017-11368 | 6.5 | Aug 9 | In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests Affected: 1.7; 1.7.1; 1.8; 1.8.1; 1.8.2; 1.8.3; +34 more |
| CVE-2016-3120 | 6.5 | Aug 1 | The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when… Affected: 1.13; 1.13.1; 1.13.2; 1.13.3; 1.13.4; 1.13.5; +4 more |
| CVE-2015-8631 | 6.5 | Feb 13 | Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a… Affected: before 1.13.4; 1.14 before 1.14.1 |
| CVE-2010-0629 | 6.5 | Apr 7 | Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of… Affected: 1.5 through 1.6.3 |
| CVE-2010-4020 | 6.3 | Dec 2 | MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2)… Affected: 1.8; 1.8.1; 1.8.2; 1.8.3 |
| CVE-2024-26462 | 5.5 | Feb 29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c Affected: 1.21.2 |
| CVE-2024-26458 | 5.3 | Feb 29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c Affected: 1.21.2 |
| CVE-2016-3119 | 5.3 | Mar 26 | The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through… Affected: 1.0; 1.0.6; 1.1; 1.1.1; 1.2; 1.2; +34 more |
| CVE-2015-8629 | 5.3 | Feb 13 | The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters… Affected: before 1.13.4; 1.14 before 1.14.1 |
| CVE-2018-5729 | 4.7 | Mar 6 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or… Affected: 5-1.6 before 5-1.21.2 |
| CVE-2018-5730 | 3.8 | Mar 6 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a… Affected: 5-1.6 before 5-1.21.2 |
| CVE-2010-1323 | 3.7 | Dec 2 | MIT Kerberos 5 (aka krb5) 1.3.x, 1.4.x, 1.5.x, 1.6.x, 1.7.x, and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers… Affected: 1.3; 1.3; 1.3.1; 1.3.2; 1.3.3; 1.3.4; +20 more |
| CVE-2010-1324 | 3.7 | Dec 2 | MIT Kerberos 5 (aka krb5) 1.7.x and 1.8.x through 1.8.3 does not properly determine the acceptability of checksums, which might allow remote attackers to forge GSS tokens, gain… Affected: 1.7; 1.7.1; 1.8; 1.8.1; 1.8.2; 1.8.3 |
| CVE-2015-2698 | – | Nov 13 | The iakerb_gss_export_sec_context function in lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) 1.14 pre-release 2015-09-14 improperly accesses a certain pointer, which allows… Affected: 1.14 |
| CVE-2015-2697 | – | Nov 9 | The build_principal_va function in lib/krb5/krb/bld_princ.c in MIT Kerberos 5 (aka krb5) before 1.14 allows remote authenticated users to cause a denial of service (out-of-bounds… Affected: before 1.14 |
| CVE-2015-2696 | – | Nov 9 | lib/gssapi/krb5/iakerb.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service (incorrect… Affected: before 1.14 |
| CVE-2015-2695 | – | Nov 9 | lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) before 1.14 relies on an inappropriate context handle, which allows remote attackers to cause a denial of service… Affected: before 1.14 |
| CVE-2015-2694 | – | May 25 | The kdcpreauth modules in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.2 do not properly track whether a client's request has been validated, which allows remote… Affected: 1.12; 1.12.1; 1.12.2; 1.12.3; 1.13; 1.13.1 |
| CVE-2014-5355 | – | Feb 20 | MIT Kerberos 5 (aka krb5) through 1.13.1 incorrectly expects that a krb5_read_message data field is represented as a string ending with a '\0' character, which allows remote… Affected: 1.1; 1.2; 1.2.1; 1.2.2; 1.2.3; 1.2.4; +34 more |
| CVE-2014-9423 | – | Feb 19 | The svcauth_gss_accept_sec_context function in lib/rpc/svc_auth_gss.c in MIT Kerberos 5 (aka krb5) 1.11.x through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 transmits… Affected: 1.11; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; +4 more |
| CVE-2014-9422 | – | Feb 19 | The check_rpcsec_auth function in kadmin/server/kadm_rpc_svc.c in kadmind in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 allows… Affected: 1.11; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; +4 more |
| CVE-2014-9421 | – | Feb 19 | The auth_gssapi_unwrap_data function in lib/rpc/auth_gssapi_misc.c in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through 1.12.2, and 1.13.x before 1.13.1 does not properly… Affected: 1.11; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; +4 more |
| CVE-2014-5352 | – | Feb 19 | The krb5_gss_process_context_token function in lib/gssapi/krb5/process_context_token.c in the libgssapi_krb5 library in MIT Kerberos 5 (aka krb5) through 1.11.5, 1.12.x through… Affected: 1.11; 1.11.1; 1.11.2; 1.11.3; 1.11.4; 1.11.5; +4 more |
| CVE-2014-5354 | – | Dec 16 | plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a… Affected: 1.12; 1.12.1; 1.12.2 |
| CVE-2014-5353 | – | Dec 16 | The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows… Affected: before 1.13.1 |
| CVE-2014-5351 | – | Oct 10 | The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold… Affected: 1.12.2 |
| CVE-2014-4345 | – | Aug 14 | Off-by-one error in the krb5_encode_krbsecretkey function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) 1.6.x… Affected: 1.6; 1.6.1; 1.6.2; 1.7; 1.7.1; 1.8; +24 more |
| CVE-2014-4344 | – | Aug 14 | The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.5.x through 1.12.x before 1.12.2 allows remote attackers to… Affected: 1.10; 1.10.1; 1.10.2; 1.10.3; 1.10.4; 1.11; +7 more |
| CVE-2014-4343 | – | Aug 14 | Double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (aka krb5) 1.10.x through 1.12.x before… Affected: 1.10; 1.10.1; 1.10.2; 1.10.3; 1.10.4; 1.11; +7 more |