Medium ELSA-2024-9331 3 CVEs

Moderate: krb5 security update (Oracle Linux 9)

Published Nov 14, 2024 · Updated Nov 14, 2024

Ecosystem: Oracle Linux

Summary

[1.21.1-3.0.1]
- Fixed race condition in krb5_set_password() [Orabug: 33609767]

[1.21.1-3]
- CVE-2024-37370 CVE-2024-37371
Fix vulnerabilities in GSS message token handling
Resolves: RHEL-45402 RHEL-45392

Fixed packages 7

Release	Package	Fixed in
Oracle Linux · 9	krb5-devel	0:1.21.1-3.0.1.el9
Oracle Linux · 9	krb5-libs	0:1.21.1-3.0.1.el9
Oracle Linux · 9	krb5-pkinit	0:1.21.1-3.0.1.el9
Oracle Linux · 9	krb5-server	0:1.21.1-3.0.1.el9
Oracle Linux · 9	krb5-server-ldap	0:1.21.1-3.0.1.el9
Oracle Linux · 9	krb5-workstation	0:1.21.1-3.0.1.el9
Oracle Linux · 9	libkadm5	0:1.21.1-3.0.1.el9

Vulnerabilities 3

High 7.5

CVE-2024-26461

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.

krb5 krb5 krb5 Debian Ubuntu Azure Linux

Feb 26, 2024
Medium 5.5

CVE-2024-26462

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/kdc/ndr.c.

krb5 krb5 krb5 Debian Ubuntu Azure Linux

Feb 26, 2024
Medium 5.3

CVE-2024-26458

Kerberos 5 (aka krb5) 1.21.2 contains a memory leak in /krb5/src/lib/rpc/pmap_rmt.c.

krb5 krb5 krb5 Debian Ubuntu Azure Linux

Feb 26, 2024