Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-28196: A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
Fixed packages 8
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | krb5-debuginfo | 0:1.15.1-37.amzn2.2.3 |
| Amazon Linux · 2 | krb5-devel | 0:1.15.1-37.amzn2.2.3 |
| Amazon Linux · 2 | krb5-libs | 0:1.15.1-37.amzn2.2.3 |
| Amazon Linux · 2 | krb5-pkinit | 0:1.15.1-37.amzn2.2.3 |
| Amazon Linux · 2 | krb5-server | 0:1.15.1-37.amzn2.2.3 |
| Amazon Linux · 2 | krb5-server-ldap | 0:1.15.1-37.amzn2.2.3 |
| Amazon Linux · 2 | krb5-workstation | 0:1.15.1-37.amzn2.2.3 |
| Amazon Linux · 2 | libkadm5 | 0:1.15.1-37.amzn2.2.3 |
Vulnerabilities 1
-
High 7.5
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerber…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-28196.html