medium6.5
CVE-2017-7562
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates.
Impact
An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Enterprise Linux | Version 7.0 |
| Redhat | Enterprise Linux Desktop | Version 7.0 |
| Redhat | Enterprise Linux Server | Version 7.0 |
| Redhat | Enterprise Linux Workstation | Version 7.0 |
| Mit | Kerberos 5 | from 1.0 before 1.16.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://www.securityfocus.com/bid/100511
- https://access.redhat.com/errata/RHSA-2018:0666
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7562
- https://github.com/krb5/krb5/pull/694
- https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196
- https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2
- https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627d
- http://www.securityfocus.com/bid/100511
- https://access.redhat.com/errata/RHSA-2018:0666
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7562
- https://github.com/krb5/krb5/pull/694
- https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196
- https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2
- https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627d