Description
The do_standalone function in the MIT krb5 KDC database propagation daemon (kpropd) in Kerberos 1.7, 1.8, and 1.9, when running in standalone mode, does not properly handle when a worker child process "exits abnormally," which allows remote attackers to cause a denial of service (listening process termination, no new connections, and lack of updates in slave KVC) via unspecified vectors.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.8.3+dfsg-5 | — |
| Debian 13 | krb5 | 1.8.3+dfsg-5 | — |
| Debian 12 | krb5 | 1.8.3+dfsg-5 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | krb5 +6 | 1.8.2-3.el6_0.4 | RHSA-2011:0200 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | krb5 | 1.15-1.1 | openSUSE-SU-2024:10004-1 |
Advisories 2
- RHSA-2011:0200 Red Hat Security Advisory: krb5 security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- openSUSE-SU-2024:10004-1 krb5-1.15-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- 20110208 MITKRB5-SA-2011-001 kpropd denial of service [CVE-2010-4022] mailing-list
- MDVSA-2011:025 vendor-advisory
- http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-001.txt
- 1025035 vdb-entry
- ADV-2011-0347 vdb-entry
- 43260 third-party-advisory
- ADV-2011-0333 vdb-entry
- ADV-2011-0329 vdb-entry
- SUSE-SR:2011:004 vendor-advisory
- ADV-2011-0464 vdb-entry
- 46269 vdb-entry
- 8070 third-party-advisory
- 43275 third-party-advisory
- RHSA-2011:0200 vendor-advisory