Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2018-5730: MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN. 1551082: CVE-2018-5730 krb5: DN container check bypass by supplying special crafted data CVE-2018-5729: MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module. 1551083: CVE-2018-5729 krb5: null dereference in kadmind or DN container check bypass by supplying special crafted data
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | krb5-debuginfo | 0:1.15.1-20.amzn2.0.1 |
| Amazon Linux · 2 | krb5-devel | 0:1.15.1-20.amzn2.0.1 |
| Amazon Linux · 2 | krb5-libs | 0:1.15.1-20.amzn2.0.1 |
| Amazon Linux · 2 | krb5-pkinit | 0:1.15.1-20.amzn2.0.1 |
| Amazon Linux · 2 | krb5-server | 0:1.15.1-20.amzn2.0.1 |
| Amazon Linux · 2 | krb5-server-ldap | 0:1.15.1-20.amzn2.0.1 |
| Amazon Linux · 2 | krb5-workstation | 0:1.15.1-20.amzn2.0.1 |
| Amazon Linux · 2 | libkadm5 | 0:1.15.1-20.amzn2.0.1 |
Vulnerabilities 2
-
Unscored —
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to …
-
Unscored —
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to …