Description
The kadm5_randkey_principal_3 function in lib/kadm5/srv/svr_principal.c in kadmind in MIT Kerberos 5 (aka krb5) before 1.13 sends old keys in a response to a -randkey -keepold request, which allows remote authenticated users to forge tickets by leveraging administrative access.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.12.1+dfsg-10 | — |
| Debian 13 | krb5 | 1.12.1+dfsg-10 | — |
| Debian 12 | krb5 | 1.12.1+dfsg-10 | — |
| Debian 7 | krb5 | 1.10.1+dfsg-5+deb7u9 | DLA-1265-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | krb5 | 1.12+dfsg-2ubuntu5.1 | USN-2498-1 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 | krb5 | 1.12.1-9.1 | SUSE-SU-2015:0290-2, SUSE-SU-2015:0290-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 | krb5 | 1.12.1-9.1 | SUSE-SU-2015:0290-2, SUSE-SU-2015:0290-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | krb5 | 1.15-1.1 | openSUSE-SU-2024:10004-1 |
Advisories 5
- USN-2498-1 krb5 vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DLA-1265-1 krb5 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10004-1 krb5-1.15-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:0290-2 Security update for krb5 SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2015:0290-1 Security update for krb5 SUSE / openSUSE Security Updates · Feb 4, 2026
References
- http://krbdev.mit.edu/rt/Ticket/Display.html?id=8018
- 1031003 vdb-entry
- FEDORA-2015-2382 vendor-advisory
- [debian-lts-announce] 20180131 [SECURITY] [DLA 1265-1] krb5 security update mailing-list
- openSUSE-SU-2015:0255 vendor-advisory
- http://advisories.mageia.org/MGASA-2014-0477.html
- SUSE-SU-2015:0290 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1145425
- MDVSA-2014:224 vendor-advisory
- GLSA-201412-53 vendor-advisory
- USN-2498-1 vendor-advisory
- 70380 vdb-entry
- kerberos-cve20145351-sec-bypass(97028) vdb-entry
- https://github.com/krb5/krb5/commit/af0ed4df4dfae762ab5fb605f5a0c8f59cb4f6ca
- FEDORA-2014-11940 vendor-advisory