Mark Deneen

**Name of the Vulnerable Software and Affected Versions** MIT Kerberos 5 versions 1.8 through 1.8.4 MIT Kerberos 5 versions 1.9 through 1.9.1 mit-krb5 versions prior to 1.9.2-r1 krb5-plugin-kdb-ldap (affected versions not specified) krb5-server (affected versions not specified) krb5-devel-32bit (affected versions not specified) krb5-devel (affected versions not specified) krb5 (affected versions not specified) krb5-32bit (affected versions not specified) krb5-client (affected versions not specified) krb5-plugin-preauth-pkinit (affected versions not specified) **Description** The issue is related to multiple vulnerabilities in the MIT Kerberos 5 package, which can lead to disruption of protected information availability. These vulnerabilities can be exploited remotely. The `krb5 ldap lockout audit` function in the Key Distribution Center (KDC) is affected when the LDAP back end is used, allowing remote attackers to cause a denial of service via unspecified vectors. **Recommendations** For MIT Kerberos 5 versions 1.8 through 1.8.4 and 1.9 through 1.9.1, update to a version outside of these ranges to resolve the issue. For mit-krb5 versions prior to 1.9.2-r1, update to version 1.9.2-r1 or later. For krb5-plugin-kdb-ldap, krb5-server, krb5-devel-32bit, krb5-devel, krb5, krb5-32bit, krb5-client, and krb5-plugin-preauth-pkinit, at the moment, there is no information about a newer version that contains a fix for this vulnerability.