Skip to content
OpenAdvisories
Medium ALAS2-2024-2595 2 CVEs

Moderate: krb5 security update (Amazon Linux 2)

Published Jul 18, 2024 · Updated Jul 22, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2024-37371: In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields. CVE-2024-37370: krb5: GSS message token handling

Fixed packages 8

ReleasePackageFixed in
Amazon Linux · 2 krb5-debuginfo 0:1.15.1-55.amzn2.2.8
Amazon Linux · 2 krb5-devel 0:1.15.1-55.amzn2.2.8
Amazon Linux · 2 krb5-libs 0:1.15.1-55.amzn2.2.8
Amazon Linux · 2 krb5-pkinit 0:1.15.1-55.amzn2.2.8
Amazon Linux · 2 krb5-server 0:1.15.1-55.amzn2.2.8
Amazon Linux · 2 krb5-server-ldap 0:1.15.1-55.amzn2.2.8
Amazon Linux · 2 krb5-workstation 0:1.15.1-55.amzn2.2.8
Amazon Linux · 2 libkadm5 0:1.15.1-55.amzn2.2.8

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-37370.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-37371.html