Medium ELSA-2021-3576 2 CVEs

Moderate: krb5 security update (Oracle Linux 8)

Published Sep 23, 2021 · Updated Sep 23, 2021

Ecosystem: Oracle Linux

Summary

[1.18.2-8.3]
- Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
- Resolves: #1997600

[1.18.2-8.2]
- Rebuild for rpminspect; no code changes
- Resolves: #1983728

[1.18.2-8.1]
- Fix KDC null deref on bad encrypted challenge (CVE-2021-36222)
- Resolves: #1983728

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 8	krb5-devel	0:1.18.2-8.3.el8_4
Oracle Linux · 8	krb5-libs	0:1.18.2-8.3.el8_4
Oracle Linux · 8	krb5-pkinit	0:1.18.2-8.3.el8_4
Oracle Linux · 8	krb5-server	0:1.18.2-8.3.el8_4
Oracle Linux · 8	krb5-server-ldap	0:1.18.2-8.3.el8_4
Oracle Linux · 8	krb5-workstation	0:1.18.2-8.3.el8_4
Oracle Linux · 8	libkadm5	0:1.18.2-8.3.el8_4

Vulnerabilities 2

Unscored —

CVE-2021-36222 EPSS 11%

ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1…

krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Jul 22, 2021
Unscored —

CVE-2021-37750

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointe…

krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Aug 23, 2021