This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] MIT Kerberos 5 fixes 2 vulnerabilities

MIT fixes 2 vulnerabilities in the Kerberos 5 product with version 1.21.3 [1].

MIT Kerberos 5 - incorrect memory size (CVE-2024-37370)
CVSS 7.5 (High)

An attacker is allowed to carry out a DoS attack or cause incorrect data processing by sending specially crafted packets [1].

The vulnerability is present in product:

  • Kerberos 5; <1.21.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 26. 6. 2023.

MIT Kerberos 5 - out-of-bounds write (CVE-2024-37371)
CVSS 9.1 (Critical)

An attacker is allowed to cause a DoS attack, incorrect data processing or a leak of data from the memory of the affected machine by sending specially crafted packets [1].

The vulnerability is present in product:

  • Kerberos 5; <1.21.3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

More information:

The vulnerability was publicly disclosed 26. 6. 2024.

By CESNET, z.s.p.o. Martin Krajči on 3. 7. 2024.

CESNET, z.s.p.o. Logo