Insufficient Verification of Data Authenticity Affecting krb5-server-ldap package, versions <0:1.18.2-16.el8_6


Severity

Recommended
medium

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
2.45% (91st percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-KRB5SERVERLDAP-6158982
  • published16 Jan 2024
  • disclosed10 Nov 2020

Introduced: 10 Nov 2020

CVE-2020-17049  (opens in a new tab)
CWE-345  (opens in a new tab)

How to fix?

Upgrade RHEL:8 krb5-server-ldap to version 0:1.18.2-16.el8_6 or higher.
This issue was patched in RHSA-2024:0252.

NVD Description

Note: Versions mentioned in the description apply only to the upstream krb5-server-ldap package and not the krb5-server-ldap package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the KDC to accept it. The update addresses this vulnerability by changing how the KDC validates service tickets used with KCD.

CVSS Scores

version 3.1