All errata/sisyphus_e2k/ALT-PU-2024-10034-1
ALT-PU-2024-10034-1

Package update krb5 in branch sisyphus_e2k

Version1.21.3-alt2
Task#0
Published2024-07-16
Max severityCRITICAL
Severity:

Closed issues (2)

CVE-2024-37370
HIGH7.5

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

Published: 2024-06-28Modified: 2026-02-18
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVE-2024-37371
CRITICAL9.1

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

Published: 2024-06-28Modified: 2025-11-03
CVSS 3.xCRITICAL 9.1
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H