Skip to content
OpenAdvisories
Low ALAS2-2018-1129 2 CVEs

Low: krb5 security update (Amazon Linux 2)

Published Dec 13, 2018 · Updated Dec 19, 2018

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5730: MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. 1551082: CVE-2018-5730 krb5: DN container check bypass by supplying special crafted data CVE-2018-5729: MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. 1551083: CVE-2018-5729 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 krb5-debuginfo 0:1.15.1-20.amzn2.0.1
Amazon Linux · 2 krb5-devel 0:1.15.1-20.amzn2.0.1
Amazon Linux · 2 krb5-libs 0:1.15.1-20.amzn2.0.1
Amazon Linux · 2 krb5-pkinit 0:1.15.1-20.amzn2.0.1
Amazon Linux · 2 krb5-server 0:1.15.1-20.amzn2.0.1
Amazon Linux · 2 krb5-server-ldap 0:1.15.1-20.amzn2.0.1
Amazon Linux · 2 krb5-workstation 0:1.15.1-20.amzn2.0.1
Amazon Linux · 2 libkadm5 0:1.15.1-20.amzn2.0.1

Vulnerabilities 2

  • Unscored —

    MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to …

  • Unscored —

    MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to …

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-5729.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2018-5730.html