Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-37750: A flaw was found in krb5. The Key Distribution Center (KDC) in MIT Kerberos 5 has a NULL pointer dereference via a FAST inner body that lacks a server field. An authenticated attacker could use this flaw to crash the Kerberos KDC server. The highest threat from this vulnerability is to system availability.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | krb5-debuginfo | 0:1.15.1-37.amzn2.2.4 |
| Amazon Linux · 2 | krb5-devel | 0:1.15.1-37.amzn2.2.4 |
| Amazon Linux · 2 | krb5-libs | 0:1.15.1-37.amzn2.2.4 |
| Amazon Linux · 2 | krb5-pkinit | 0:1.15.1-37.amzn2.2.4 |
| Amazon Linux · 2 | krb5-server | 0:1.15.1-37.amzn2.2.4 |
| Amazon Linux · 2 | krb5-server-ldap | 0:1.15.1-37.amzn2.2.4 |
| Amazon Linux · 2 | krb5-workstation | 0:1.15.1-37.amzn2.2.4 |
| Amazon Linux · 2 | libkadm5 | 0:1.15.1-37.amzn2.2.4 |
Vulnerabilities 1
-
Unscored —
The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointe…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-37750.html