CVE-2018-5710
Fixed in a distro release EPSS 2%
An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client.
Products: mit kerberos
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | krb5 | 1.15.3-r0 |
| Alpine 3.11 | krb5 | 1.15.3-r0 |
| Alpine 3.12 | krb5 | 1.15.3-r0 |
| Alpine 3.13 | krb5 | 1.15.3-r0 |
| Alpine 3.14 | krb5 | 1.15.3-r0 |
| Alpine 3.15 | krb5 | 1.15.3-r0 |
| Alpine 3.16 | krb5 | 1.15.3-r0 |
| Alpine 3.17 | krb5 | 1.15.3-r0 |
| Alpine 3.18 | krb5 | 1.15.3-r0 |
| Alpine 3.19 | krb5 | 1.15.3-r0 |
| Alpine 3.20 | krb5 | 1.15.3-r0 |
| Alpine 3.21 | krb5 | 1.15.3-r0 |
| Alpine 3.22 | krb5 | 1.15.3-r0 |
| Alpine 3.23 | krb5 | 1.15.3-r0 |
| Alpine 3.24 | krb5 | 1.15.3-r0 |
| Alpine 3.7 | krb5 | 1.15.3-r0 |
| Alpine 3.8 | krb5 | 1.15.3-r0 |
| Alpine 3.9 | krb5 | 1.15.3-r0 |
| Debian 12 | krb5 | 1.16.1-1 |
| Debian 13 | krb5 | 1.16.1-1 |
| Debian 14 | krb5 | 1.16.1-1 |
| Debian 8 | krb5 | 1.12.1+dfsg-19+deb8u5 |
| Debian 9 | krb5 | 1.15-1+deb9u3 |
| Ubuntu 14.04 LTS | krb5 | 1.12+dfsg-2ubuntu5.4 |
| Ubuntu 16.04 LTS | krb5 | 1.13.2+dfsg-5ubuntu2.1 |
| Ubuntu 18.04 LTS | krb5 | 1.16-2ubuntu0.1 |