ArchLinux: 201806-3: krb5: insufficient validation
Summary
- CVE-2018-5729 (insufficient validation)
A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user
with permission to add principals to an LDAP Kerberos database can
cause a null dereference in kadmind, or circumvent a DN container
check, by supplying tagged data intended to be internal to the database
module.
- CVE-2018-5730 (insufficient validation)
A flaw was found in MIT krb5 1.6 or later, an authenticated kadmin user
with permission to add principals to an LDAP Kerberos database can
circumvent a DN containership check by supplying both a "linkdn" and
"containerdn" database argument, or by supplying a DN string which is a
left extension of a container DN string but is not hierarchically
within the container DN.
Resolution
Upgrade to 1.16.1-1.
# pacman -Syu "krb5>=1.16.1-1"
The problems have been fixed upstream in version 1.16.1.
References
https://github.com/krb5/krb5/commit/e1caf6fb74981da62039846931ebdffed71309d1 https://security.archlinux.org/CVE-2018-5729 https://security.archlinux.org/CVE-2018-5730
![Dist Arch](/images/distros/dist-arch.png)
Workaround
None.