Summary
[0.3.2-3.0.1]
- Use DNS discovery for declared realms only (CVE-2025-59088) [Orabug: 38745300]
- Fix DoS vulnerability based on unbounded TCP buffering (CVE-2025-59089)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 7 | python-kdcproxy | 0:0.3.2-3.0.1.el7 |
Vulnerabilities 2
-
High 8.6
Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv
If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, si…
-
Medium 5.9
Python-kdcproxy: remote dos via unbounded tcp upstream buffering
If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While rece…