Skip to content
OpenAdvisories
Medium ELSA-2023-6699 2 CVEs

Moderate: krb5 security and bug fix update (Oracle Linux 9)

Published Nov 11, 2023 · Updated Nov 11, 2023

Ecosystem: Oracle Linux

Summary

[1.21.1-1.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]

[1.21.1-1]
- New upstream version (1.21.1)
- Fix double-free in KDC TGS processing (CVE-2023-39975)
- Add support for 'pac_privsvr_enctype' KDB string attribute
Resolves: rhbz#2060421

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 9 krb5-devel 0:1.21.1-1.0.1.el9
Oracle Linux · 9 krb5-libs 0:1.21.1-1.0.1.el9
Oracle Linux · 9 krb5-pkinit 0:1.21.1-1.0.1.el9
Oracle Linux · 9 krb5-server 0:1.21.1-1.0.1.el9
Oracle Linux · 9 krb5-server-ldap 0:1.21.1-1.0.1.el9
Oracle Linux · 9 krb5-workstation 0:1.21.1-1.0.1.el9
Oracle Linux · 9 libkadm5 0:1.21.1-1.0.1.el9

Vulnerabilities 2

  • High 8.8
    CVE-2023-39975

    kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticate…

  • Unscored —
    CVE-2023-36054

    lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized poi…

    krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine