CVE-2019-12098
Fixed in a distro release EPSS 2%CVSS 7.4
In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
Products: heimdal_project heimdal, fedoraproject fedora, opensuse backports_sle, opensuse leap, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Alpine 3.10 | heimdal | 7.5.0-r5 |
| Alpine 3.7 | heimdal | 7.4.0-r4 |
| Alpine 3.8 | heimdal | 7.5.0-r3 |
| Alpine 3.9 | heimdal | 7.5.0-r4 |
| Debian 12 | heimdal | 7.5.0+dfsg-3 |
| Debian 13 | heimdal | 7.5.0+dfsg-3 |
| Debian 14 | heimdal | 7.5.0+dfsg-3 |
| Debian 9 | heimdal | 7.1.0+dfsg-13+deb9u3 |
| SUSE Package Hub 15 | libheimdal | 7.7.0-bp150.2.3.1 |
| SUSE Package Hub 15 SP1 | libheimdal | 7.7.0-bp151.4.3.1 |
| Ubuntu 18.04 LTS | heimdal | 7.5.0+dfsg-1ubuntu0.1 |
| Ubuntu 20.04 LTS | heimdal | 7.7.0+dfsg-1ubuntu1.1 |
| Ubuntu Pro 14.04 LTS | heimdal | 1.6~git20131207+dfsg-1ubuntu1.2+esm1 |
| Ubuntu Pro 16.04 LTS | heimdal | 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1 |
| openSUSE Leap 15.0 | libheimdal | 7.7.0-lp151.3.3.1 |
| openSUSE Leap 15.1 | libheimdal | 7.7.0-lp151.3.3.1 |