Medium ELSA-2024-6166 2 CVEs

Moderate: krb5 security update (Oracle Linux 9)

Published Sep 3, 2024 · Updated Sep 3, 2024

Ecosystem: Oracle Linux

Summary

[1.21.1-2.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]

[1.21.1-2]
- CVE-2024-37370 CVE-2024-37371
Fix vulnerabilities in GSS message token handling
Resolves: RHEL-45401 RHEL-45390

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 9	krb5-devel	0:1.21.1-2.0.1.el9_4
Oracle Linux · 9	krb5-libs	0:1.21.1-2.0.1.el9_4
Oracle Linux · 9	krb5-pkinit	0:1.21.1-2.0.1.el9_4
Oracle Linux · 9	krb5-server	0:1.21.1-2.0.1.el9_4
Oracle Linux · 9	krb5-server-ldap	0:1.21.1-2.0.1.el9_4
Oracle Linux · 9	krb5-workstation	0:1.21.1-2.0.1.el9_4
Oracle Linux · 9	libkadm5	0:1.21.1-2.0.1.el9_4

Vulnerabilities 2

Critical 9.1

CVE-2024-37371

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handlin…

krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Jun 28, 2024
High 7.5

CVE-2024-37370

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GS…

krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Jun 28, 2024