Most recent entries from all

ALSA-2024:5312 — Moderate: krb5 security update

Affected: AlmaLinux:8: krb5-devel, AlmaLinux:8: krb5-libs, AlmaLinux:8: krb5-pkinit, AlmaLinux:8: krb5-server, AlmaLinux:8: krb5-server-ldap, AlmaLinux:8: krb5-workstation, AlmaLinux:8: libkadm5

Kerberos is a network authentication system, which can improve the security of your network by eliminating the insecure practice of sending passwords over the network in unencrypted form. It allows clients and servers to authenticate to each other with the help of a trusted third party, the Kerberos key distribution center (KDC).

Security Fix(es):

* krb5: GSS message token handling (CVE-2024-37371) * krb5: GSS message token handling (CVE-2024-37370)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

bdu:2024-07016

BELL-CVE-2024-37370

Affected: Alpaquita:23: krb5, Alpaquita:stream: krb5

certfr-2024-avi-0884 — De multiples vulnérabilités ont été découvertes dans Oracle MySQL. Elles permettent à un attaquant de provoquer un déni…

certfr-2024-avi-0884

CLEANSTART-2024-TH47154 — In MIT Kerberos 5 (aka krb5) before 1

Affected: CleanStart: krb5

Security vulnerability affects the krb5 package. In MIT Kerberos 5 (aka krb5) before 1.

EUVD-2026-336285

fkie_cve-2024-37370

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

GHSA-wvrw-2fv8-cjvx

ICSA-25-162-05 — Siemens SIMATIC S7-1500 CPU family

sshd in OpenSSH 6.2 through 8.x before 8.8, when certain non-default configurations are used, allows privilege escalation because supplemental groups are not initialized as expected. Helper programs for AuthorizedKeysCommand and AuthorizedPrincipalsCommand may run with privileges associated with group memberships of the sshd process, if the configuration specifies running the command as a different user. A flaw was found in glibc. When the getaddrinfo function is called with the AF_UNSPEC address family and the system is configured with no-aaaa mode via /etc/resolv.conf, a DNS response via TCP larger than 2048 bytes can potentially disclose stack contents through the function returned address data, and may cause a crash. A flaw was found in glibc. In an extremely rare situation, the getaddrinfo function may access memory that has been freed, resulting in an application crash. This issue is only exploitable when a NSS module implements only the _nss_*_gethostbyname2_r and _nss_*_getcanonname_r hooks without implementing the _nss_*_gethostbyname3_r hook. The resolved name should return a large number of IPv6 and IPv4, and the call to the getaddrinfo function should have the AF_INET6 address family with AI_CANONNAME, AI_ALL and AI_V4MAPPED as flags. A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue could allow a local attacker to use maliciously crafted GLIBC_TUNABLES environment var…

msrc_CVE-2024-37370 — In MIT Kerberos 5 (aka krb5) before 1.21.3 an attacker can modify the plaintext Extra Count field of a confidential GSS…

msrc_CVE-2024-37370

OESA-2024-1825 — krb5 security update

Affected: openEuler:22.03-LTS-SP3: krb5, openEuler:20.03-LTS-SP4: krb5, openEuler:24.03-LTS: krb5, openEuler:22.03-LTS-SP4: krb5, openEuler:22.03-LTS-SP1: krb5

Kerberos is a network authentication protocol. It is designed to provide strong authentication for client/server applications by using secret-key cryptography.

Security Fix(es):

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.(CVE-2024-37371)

openSUSE-SU-2024:14111-1 — krb5-1.21.3-1.1 on GA media

krb5-1.21.3-1.1 on GA media

RHBA-2024:6585 — Red Hat Bug Fix Advisory: Updated rhel9/toolbox container image

glib2: Signal subscription vulnerabilities krb5: GSS message token handling krb5: GSS message token handling

SSA-082556 — SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5

Multiple vulnerabilities have been identified in the additional GNU/Linux subsystem of the firmware version V3.1.5 for the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP (incl. SIPLUS variant).

Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends specific countermeasures for products where fixes are not, or not yet available.

Note: This SSA advises vulnerabilities for firmware version V3.1.5 only; for version V3.1.6 refer to SSA-019113.

SUSE-SU-2024:2300-1 — Security update for krb5

Security update for krb5

UBUNTU-CVE-2024-37370

Affected: Ubuntu:Pro:14.04:LTS: krb5, Ubuntu:Pro:16.04:LTS: krb5, Ubuntu:Pro:18.04:LTS: krb5, Ubuntu:20.04:LTS: krb5, Ubuntu:22.04:LTS: krb5, Ubuntu:24.04:LTS: krb5

WID-SEC-W-2024-1467 — MIT Kerberos: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MIT Kerberos ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.