PT-2020-7943 · Node-Krb5 · Node-Krb5

Published 2020-09-01 · Updated 2020-09-01 · CVE-2016-1000238

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions: node-krb5 (affected versions not specified)

Description: The issue concerns the lack of validation of the KDC prior to authentication in affected versions, potentially allowing an attacker with network access to spoof the KDC and impersonate a valid user without knowing their credentials.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a mitigation measure, consider using an alternative module that is actively maintained and provides similar functionality.

Related Identifiers

CVE-2016-1000238

GHSA-4V9Q-HM2P-68C4

Affected Products

Node-Krb5

References · 6

• https://osv.dev/vulnerability/GHSA-4v9q-hm2p-68c4 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-1000238 · Security Note
• http://archive.hack.lu/2010/Bouillon-Stealing-credentials-for-impersonation.pdf · Note
• https://npmjs.com/advisories/136 · Note
• ❌ https://github.com/qesuto/node-krb5 · Note, Deleted
• ❌ https://github.com/qesuto/node-krb5/issues/13 · Note, Deleted