Alerts This Week
Warning Icon 1 727
Alerts This Week
Warning Icon 1 727

Mageia 7: 2021-0022 Moderate: krb5 Unbounded Recursion DoS Risk

mageia
Calendar Grey January 14, 2021
Dist Mageia Esm H88
Newly released krb5 updates address a vulnerability linked to infinite recursion within Kerberos communications. This update was made available on: 14 Jan 2021.
MIT Kerberos 5 (aka krb5) before 1.17.2 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths...

Summary

MIT Kerberos 5 (aka krb5) before 1.17.2 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit (CVE-2020-28196).

References

- https://bugs.mageia.org/show_bug.cgi?id=27594

- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-28196

- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/

- https://www.cve.org/CVERecord?id=CVE-2020-28196

Topics%20covered

Topics Covered

security advisory security fix kerberos krb5 asn.1 mageia recursion issue recursion

Resolution

SRPMS

- 7/core/krb5-1.17-2.1.mga7

Severity
important
Lowest
Low
Medium
High
Critical

Publication date: 14 Jan 2021
URL: https://advisories.mageia.org/MGASA-2021-0022.html
Type: security
CVE: CVE-2020-28196

Topics%20covered

Topics Covered

security advisory security fix kerberos krb5 asn.1 mageia recursion issue recursion

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here