Description
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | krb5 | 1.15.1-2 | — |
| Debian 13 | krb5 | 1.15.1-2 | — |
| Debian 12 | krb5 | 1.15.1-2 | — |
| Debian 7 | krb5 | 1.10.1+dfsg-5+deb7u8 | DLA-1058-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | krb5 | 1.13.2+dfsg-5ubuntu2.1 | — |
| Ubuntu 14.04 LTS | krb5 | 1.12+dfsg-2ubuntu5.4 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | krb5 +7 | 1.15.1-18.el7 | RHSA-2018:0666 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | krb5 | 1.19.2-2.2 | openSUSE-SU-2024:10899-1 |
Advisories 3
- RHSA-2018:0666 Red Hat Security Advisory: krb5 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- DLA-1058-1 krb5 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10899-1 krb5-1.19.2-2.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/krb5/krb5/commit/ffb35baac6981f9e8914f8f3bffd37f284b85970
- FEDORA-2017-e5b36383f4 vendor-advisory
- RHSA-2018:0666 vendor-advisory
- 100291 vdb-entry
- FEDORA-2017-8e9d9771c4 vendor-advisory