CVE-2017-11368
Fixed in a distro release EPSS 2%
In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.
Products: fedoraproject fedora, mit kerberos, mit kerberos_5
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | krb5-devel | 1.15.1-19.amzn2.0.1 |
| Amazon Linux 2 | krb5-libs | 1.15.1-19.amzn2.0.1 |
| Amazon Linux 2 | krb5-pkinit | 1.15.1-19.amzn2.0.1 |
| Amazon Linux 2 | krb5-server | 1.15.1-19.amzn2.0.1 |
| Amazon Linux 2 | krb5-server-ldap | 1.15.1-19.amzn2.0.1 |
| Amazon Linux 2 | krb5-workstation | 1.15.1-19.amzn2.0.1 |
| Amazon Linux 2 | libkadm5 | 1.15.1-19.amzn2.0.1 |
| Arch Linux | krb5 | 1.15.2-1 |
| Debian 12 | krb5 | 1.15.1-2 |
| Debian 13 | krb5 | 1.15.1-2 |
| Debian 14 | krb5 | 1.15.1-2 |
| Debian 7 | krb5 | 1.10.1+dfsg-5+deb7u8 |
| Red Hat Enterprise Linux 7 | krb5 | 0:1.15.1-18.el7 |
| Red Hat Enterprise Linux 7 | krb5-debuginfo | 0:1.15.1-18.el7 |
| Red Hat Enterprise Linux 7 | krb5-devel | 0:1.15.1-18.el7 |
| Red Hat Enterprise Linux 7 | krb5-libs | 0:1.15.1-18.el7 |
| Red Hat Enterprise Linux 7 | krb5-pkinit | 0:1.15.1-18.el7 |
| Red Hat Enterprise Linux 7 | krb5-server | 0:1.15.1-18.el7 |
| Red Hat Enterprise Linux 7 | krb5-server-ldap | 0:1.15.1-18.el7 |
| Red Hat Enterprise Linux 7 | krb5-workstation | 0:1.15.1-18.el7 |
| Red Hat Enterprise Linux 7 | libkadm5 | 0:1.15.1-18.el7 |
| Ubuntu 14.04 LTS | krb5 | 1.12+dfsg-2ubuntu5.4 |
| Ubuntu 16.04 LTS | krb5 | 1.13.2+dfsg-5ubuntu2.1 |
| openSUSE Tumbleweed | krb5 | 1.19.2-2.2 |