2024-06-29
ALT-BU-2024-9465-1
Branch sisyphus_riscv64 update bulletin.
Package krb5 updated to version 1.21.3-alt1 for branch sisyphus_riscv64.
Closed vulnerabilities
Published: 2024-06-29
Modified: 2025-03-13
Modified: 2025-03-13
CVE-2024-37370
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.
Severity: HIGH (7.5)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References:
- https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
- https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
- https://security.netapp.com/advisory/ntap-20241108-0007/
- https://web.mit.edu/kerberos/www/advisories/
- https://web.mit.edu/kerberos/www/advisories/
Published: 2024-06-29
Modified: 2025-03-14
Modified: 2025-03-14
CVE-2024-37371
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.
Severity: CRITICAL (9.1)
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
References:
- https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
- https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
- https://security.netapp.com/advisory/ntap-20241108-0009/
- https://web.mit.edu/kerberos/www/advisories/
- https://web.mit.edu/kerberos/www/advisories/