PT-2017-6645 · Python · Python-Kerberos

Res@… · Publicado 2017-08-25 · Atualizado 2022-05-14 · CVE-2015-3206

Positive Technologies (AI Summary)

CVSS v4.0

9.2

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions python-kerberos (affected versions not specified)

Description The issue concerns the checkPassword function in python-kerberos, which fails to authenticate the KDC it attempts to communicate with. This allows remote attackers to cause a denial of service or have other unspecified impact by performing a man-in-the-middle attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Enumeração de Fraquezas

CWE-287

Identificadores relacionados

CVE-2015-3206

DLA-265-1

DLA-265-2

GHSA-MFFC-9GX5-99G3

PYSEC-2017-49

PYSEC-2017-66

Produtos afetados

Python-Kerberos

Referências · 21

• https://github.com/pypa/advisory-database/tree/main/vulns/kerberos/PYSEC-2017-49.yaml · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/pykerberos/PYSEC-2017-66.yaml · Nota
• https://github.com/apple/ccs-pykerberos · Nota
• https://github.com/apple/ccs-pykerberos/issues/31 · Correção
• https://github.com/apple/ccs-pykerberos/commit/9cb61c93f9b24dd18a0a315f3df5445529c5c333 · Nota
• https://osv.dev/vulnerability/CVE-2015-3206 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2015-3206 · Nota de Segurança
• https://osv.dev/vulnerability/PYSEC-2017-66 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2015-3206 · Aviso do Fabricante
• https://osv.dev/vulnerability/UBUNTU-CVE-2015-3206 · Aviso do Fabricante
• https://pypi.python.org/pypi/kerberos · Aviso do Fabricante
• https://web.archive.org/web/20150910143429/https://trac.calendarserver.org/ticket/833 · Nota
• http://openwall.com/lists/oss-security/2015/05/21/3 · Correção
• https://osv.dev/vulnerability/PYSEC-2017-49 · Aviso do Fabricante
• https://web.archive.org/web/20200228090829/http://securityfocus.com/bid/74760 · Nota