Most recent entries from all

ALSA-2023:2570 — Moderate: krb5 security, bug fix, and enhancement update

Affected: AlmaLinux:9: krb5-devel, AlmaLinux:9: krb5-libs, AlmaLinux:9: krb5-pkinit, AlmaLinux:9: krb5-server, AlmaLinux:9: krb5-server-ldap, AlmaLinux:9: krb5-workstation, AlmaLinux:9: libkadm5

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

The following packages have been upgraded to a later upstream version: krb5 (1.20.1). (BZ#2016312)

Security Fix(es):

* Kerberos: delegation constrain bypass in S4U2Proxy (CVE-2020-17049)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2020-05328

certfr-2020-avi-738 — De multiples vulnérabilités ont été corrigées dans Microsoft Windows. Elles permettent à un…

certfr-2020-avi-738

EUVD-2026-201795

fkie_cve-2020-17049

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

GHSA-g2p3-j47p-8cwj

Kerberos Security Feature Bypass Vulnerability

gsd-2020-17049

openSUSE-SU-2024:13200-1 — python310-impacket-0.11.0-2.1 on GA media

python310-impacket-0.11.0-2.1 on GA media

RHSA-2024:0137 — Red Hat Security Advisory: idm:DL1 security update

Kerberos: delegation constrain bypass in S4U2Proxy ipa: Invalid CSRF protection

WID-SEC-W-2022-0302 — Xerox FreeFlow Print Server: Mehrere Schwachstellen ermöglichen Ausführen von beliebigem Programmcode mit Administrator…

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Xerox FreeFlow Print Server ausnutzen, um beliebigen Programmcode auszuführen, einen Cross-Site-Scripting-Angriff durchzuführen, Informationen offenzulegen, einen Denial-of-Service-Zustand zu verursachen oder Dateien zu manipulieren.