Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-26462: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c. CVE-2024-26461: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c. CVE-2024-26458: Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.
Fixed packages 15
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | krb5-debuginfo | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-debugsource | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-devel | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-libs | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-libs-debuginfo | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-pkinit | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-pkinit-debuginfo | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-server | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-server-debuginfo | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-server-ldap | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-server-ldap-debuginfo | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-workstation | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | krb5-workstation-debuginfo | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | libkadm5 | 0:1.21-3.amzn2023.0.4 |
| Amazon Linux · 2023 | libkadm5-debuginfo | 0:1.21-3.amzn2023.0.4 |
Vulnerabilities 3
-
High 7.5
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
-
Medium 5.5
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.
-
Medium 5.3
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.