Skip to content
OpenAdvisories
High ELSA-2024-8788 1 CVE

Important: krb5 security update (Oracle Linux 7)

Published Nov 30, 2024 · Updated Nov 30, 2024

Ecosystem: Oracle Linux

Summary

[1.15.1-55.0.7]
- libkrad: implement support for Message-Authenticator (CVE-2024-3596) [Orabug: 37241077]

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 7 krb5-devel 0:1.15.1-55.0.7.el7_9
Oracle Linux · 7 krb5-libs 0:1.15.1-55.0.7.el7_9
Oracle Linux · 7 krb5-pkinit 0:1.15.1-55.0.7.el7_9
Oracle Linux · 7 krb5-server 0:1.15.1-55.0.7.el7_9
Oracle Linux · 7 krb5-server-ldap 0:1.15.1-55.0.7.el7_9
Oracle Linux · 7 krb5-workstation 0:1.15.1-55.0.7.el7_9
Oracle Linux · 7 libkadm5 0:1.15.1-55.0.7.el7_9

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine