PT-2019-4948 · Heimdal+3 · Heimdal+3
Jeffrey Altman
·
Publicado
2019-05-15
·
Atualizado
2022-10-13
·
CVE-2019-12098
CVSS v2.0
8.8
Alta
| Vetor | AV:N/AC:M/Au:N/C:C/I:C/A:N |
Name of the Vulnerable Software and Affected Versions
Heimdal versions prior to 7.6.0
Description
The issue is related to the implementation of the Kerberos protocol in Heimdal, specifically with errors in cryptographic key management. This allows a remote attacker to perform a man-in-the-middle attack due to the failure to verify anonymous PKINIT PA-PKINIT-KX key exchange. The problem is located in the
krb5 init creds step function in lib/krb5/init creds pw.c.Recommendations
For Heimdal versions prior to 7.6.0, update to version 7.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the
krb5 init creds step function until a patch is available.Correção
Improper Certificate Validation
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Heimdal
Linuxmint
Suse
Ubuntu