6.9
Moyenne
CVE-2026-107708 MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that…
Description
MIT krb5 through 1.22.2 contains a NULL pointer dereference vulnerability in the KDC's get_pac_princ_with_realm() that returns success while leaving the client principal NULL on malformed names. A malicious or compromised cross-realm trusted KDC can send an S4U2Proxy request with a PAC carrying a malformed client name to crash krb5kdc and deny authentication.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| krb5 1.22 | premières → 1.22.2 | Pas de correctif indiqué |
Autres CVE de krb5
Les 4 CVE de krb5 →
CVE-2026-107778
MIT Kerberos 5 (krb5) through 1.22.2 contains a NULL pointer dereference in make_cred_list() in rd_cred.c that allows…
7.1
Élevée
CVE-2019-14844
A flaw was found in, Fedora versions of krb5 from 1.16.1 to, including 1.17.x, in the way a Kerberos client could…
7.5
Élevée
CVE-2017-7562
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of…
6.5
Moyenne