Summary
[1.0.0-19]
- Use DNS discovery for declared realms only (CVE-2025-59088)
Resolves: RHEL-122777
- Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089)
Resolves: RHEL-122776
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 10 | python3-kdcproxy | 0:1.0.0-19.el10_1 |
Vulnerabilities 2
-
High 8.6
Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, si…
-
Medium 5.9
Python-kdcproxy: remote dos via unbounded tcp upstream buffering
If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While rece…