CVE-2023-36054
Medium
Description
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Mit Kerberos
PublishedAug 7, 2023
First seenAug 7, 2023
How to fix
Update
- mit kerberos_51.20.2 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mit kerberos_5 | v < 1.20.2, 1.21 | 1.20.2 |
| debian debian_linux | 10.0 | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp clustered_data_ontap | 9.0 | — |
| netapp hci | No range specified | — |
| netapp management_services_for_element_software | No range specified | — |
| netapp ontap_tools | No range specified | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.