K5
Product
Kerberos 5
140
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 13Medium 13Low 3
Watch
Add Kerberos 5 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-36054 | 6.5 | Aug 7 | lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer Affected: before 1.20.2; 1.21; 1.21 |
| CVE-2021-37750 | 6.5 | Aug 23 | The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointer dereference in kdc/do_tgs_req.c via a FAST inner body that… Affected: before 1.18.5; 1.19.0 before 1.19.3 |
| CVE-2017-7562 | 6.5 | Jul 26 | An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates Affected: 1.0 before 1.16.1 |
| CVE-2017-11368 | 6.5 | Aug 9 | In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests Affected: 1.7; 1.7.1; 1.8; 1.8.1; 1.8.2; 1.8.3; +34 more |
| CVE-2016-3120 | 6.5 | Aug 1 | The validate_as_request function in kdc_util.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.13.6 and 1.4.x before 1.14.3, when… Affected: 1.13; 1.13.1; 1.13.2; 1.13.3; 1.13.4; 1.13.5; +4 more |
| CVE-2015-8631 | 6.5 | Feb 13 | Multiple memory leaks in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a… Affected: before 1.13.4; 1.14 before 1.14.1 |
| CVE-2010-0629 | 6.5 | Apr 7 | Use-after-free vulnerability in kadmin/server/server_stubs.c in kadmind in MIT Kerberos 5 (aka krb5) 1.5 through 1.6.3 allows remote authenticated users to cause a denial of… Affected: 1.5 through 1.6.3 |
| CVE-2010-4020 | 6.3 | Dec 2 | MIT Kerberos 5 (aka krb5) 1.8.x through 1.8.3 does not reject RC4 key-derivation checksums, which might allow remote authenticated users to forge a (1) AD-SIGNEDPATH or (2)… Affected: 1.8; 1.8.1; 1.8.2; 1.8.3 |
| CVE-2024-26462 | 5.5 | Feb 29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c Affected: 1.21.2 |
| CVE-2024-26458 | 5.3 | Feb 29 | Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c Affected: 1.21.2 |
| CVE-2016-3119 | 5.3 | Mar 26 | The process_db_args function in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the LDAP KDB module in kadmind in MIT Kerberos 5 (aka krb5) through 1.13.4 and 1.14.x through… Affected: 1.0; 1.0.6; 1.1; 1.1.1; 1.2; 1.2; +34 more |
| CVE-2015-8629 | 5.3 | Feb 13 | The xdr_nullstring function in lib/kadm5/kadm_rpc_xdr.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters… Affected: before 1.13.4; 1.14 before 1.14.1 |
| CVE-2018-5729 | 4.7 | Mar 6 | MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or… Affected: 5-1.6 before 5-1.21.2 |
Showing 13