Skip to content
OpenAdvisories
High ELSA-2024-8860 1 CVE

Important: krb5 security update (Oracle Linux 8)

Published Nov 5, 2024 · Updated Nov 5, 2024

Ecosystem: Oracle Linux

Summary

[1.18.2-30.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]

[1.18.2-30]
- libkrad: implement support for Message-Authenticator (CVE-2024-3596)
Resolves: RHEL-50253
- Remove RSA protocol for PKINIT
Resolves: RHEL-17616

Fixed packages 7

ReleasePackageFixed in
Oracle Linux · 8 krb5-devel 0:1.18.2-30.0.1.el8_10
Oracle Linux · 8 krb5-libs 0:1.18.2-30.0.1.el8_10
Oracle Linux · 8 krb5-pkinit 0:1.18.2-30.0.1.el8_10
Oracle Linux · 8 krb5-server 0:1.18.2-30.0.1.el8_10
Oracle Linux · 8 krb5-server-ldap 0:1.18.2-30.0.1.el8_10
Oracle Linux · 8 krb5-workstation 0:1.18.2-30.0.1.el8_10
Oracle Linux · 8 libkadm5 0:1.18.2-30.0.1.el8_10

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine