Critical RHSA-2024:5076 2 CVEs

Red Hat Security Advisory: krb5 security update

Published Sep 30, 2024 · Updated Oct 17, 2026

Ecosystem: Red Hat

Fixed packages 9

Release	Package	Fixed in
Red Hat · RHEL 7 ELS rhel_els:7	krb5	0:1.15.1-55.el7_9.2
Red Hat · RHEL 7 ELS rhel_els:7	krb5-debuginfo	0:1.15.1-55.el7_9.2
Red Hat · RHEL 7 ELS rhel_els:7	krb5-devel	0:1.15.1-55.el7_9.2
Red Hat · RHEL 7 ELS rhel_els:7	krb5-libs	0:1.15.1-55.el7_9.2
Red Hat · RHEL 7 ELS rhel_els:7	krb5-pkinit	0:1.15.1-55.el7_9.2
Red Hat · RHEL 7 ELS rhel_els:7	krb5-server	0:1.15.1-55.el7_9.2
Red Hat · RHEL 7 ELS rhel_els:7	krb5-server-ldap	0:1.15.1-55.el7_9.2
Red Hat · RHEL 7 ELS rhel_els:7	krb5-workstation	0:1.15.1-55.el7_9.2
Red Hat · RHEL 7 ELS rhel_els:7	libkadm5	0:1.15.1-55.el7_9.2

Vulnerabilities 2

Critical 9.1

CVE-2024-37371

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handlin…

krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Jun 28, 2024
High 7.5

CVE-2024-37370

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GS…

krb5 krb5 krb5 krb5 Debian Ubuntu Azure Linux Alpine

Jun 28, 2024

References

article
https://access.redhat.com/security/updates/classification/#moderate
report
https://bugzilla.redhat.com/show_bug.cgi?id=2294676
report
https://bugzilla.redhat.com/show_bug.cgi?id=2294677
advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5076.json
report
https://access.redhat.com/security/cve/CVE-2024-37370
advisory
https://www.cve.org/CVERecord?id=CVE-2024-37370
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-37370
article
https://web.mit.edu/kerberos/www/krb5-1.21/
report
https://access.redhat.com/security/cve/CVE-2024-37371
advisory
https://www.cve.org/CVERecord?id=CVE-2024-37371
advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-37371
article
https://www.oracle.com/security-alerts/cpujan2025.html#AppendixMSQL