Medium ELSA-2021-4788 1 CVE

Moderate: krb5 security update (Oracle Linux 7)

Published Nov 24, 2021 · Updated Nov 24, 2021

Ecosystem: Oracle Linux

Summary

[1.15.1-51.0.1]
- Add recursion limit for ASN.1 indefinite lengths [Orabug: 32582360]

[1.15.1-51]
- Fix KDC null deref on TGS inner body null server (CVE-2021-37750)
- Resolves: #1997599

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 7	krb5-devel	0:1.15.1-51.0.1.el7_9
Oracle Linux · 7	krb5-libs	0:1.15.1-51.0.1.el7_9
Oracle Linux · 7	krb5-pkinit	0:1.15.1-51.0.1.el7_9
Oracle Linux · 7	krb5-server	0:1.15.1-51.0.1.el7_9
Oracle Linux · 7	krb5-server-ldap	0:1.15.1-51.0.1.el7_9
Oracle Linux · 7	krb5-workstation	0:1.15.1-51.0.1.el7_9
Oracle Linux · 7	libkadm5	0:1.15.1-51.0.1.el7_9

Vulnerabilities 1

Unscored —

CVE-2021-37750

The Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.5 and 1.19.x before 1.19.3 has a NULL pointe…

krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Aug 23, 2021