Skip to content
OpenAdvisories
Critical RHSA-2024:8461 1 CVE

Red Hat Security Advisory: krb5 security update

Published Oct 24, 2024 · Updated Jun 26, 2026

Ecosystem: Red Hat

Fixed packages 16

ReleasePackageFixed in
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::appstream krb5-devel 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-debuginfo 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-debugsource 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-libs 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-libs-debuginfo 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-pkinit 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-pkinit-debuginfo 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-server 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-server-debuginfo 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-server-ldap 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-server-ldap-debuginfo 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-workstation 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos krb5-workstation-debuginfo 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos libkadm5 0:1.20.1-9.el9_2.2
Red Hat · RHEL 9.2 EUS rhel_eus:9.2::baseos libkadm5-debuginfo 0:1.20.1-9.el9_2.2

Vulnerabilities 1

  • Critical 9.0
    CVE-2024-3596 Public exploit EPSS 15%

    RADIUS Protocol under RFC2865 is vulnerable to forgery attacks.

    RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response Authen…

    IETF RFC krb5 freeradius Debian Ubuntu Alpine

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2263240
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_8461.json
  • report
    https://access.redhat.com/security/cve/CVE-2024-3596
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2024-3596
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2024-3596
  • article
    https://datatracker.ietf.org/doc/draft-ietf-radext-deprecating-radius/
  • article
    https://datatracker.ietf.org/doc/html/rfc2865
  • article
    https://networkradius.com/assets/pdf/radius_and_md5_collisions.pdf
  • article
    https://w1.fi/security/2024-1/hostapd-and-radius-protocol-forgery-attacks.txt
  • article
    https://www.blastradius.fail/
  • advisory
    https://www.kb.cert.org/vuls/id/456537