CVE-2024-37371

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

References

Affected packages

Git / github.com/krb5/krb5

Affected ranges

Type

GIT

Repo

https://github.com/krb5/krb5

Events

Introduced

Fixed

8f56f544dd179056e9b8d02552e6c5e392eb2966

Fixed

55fbf435edbe2e92dd8101669b1ce7144bc96fef

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.21.3"
        }
    ]
}

Affected versions

kfw-4.*

kfw-4.3-beta1

kfw-4.3-beta1-mit

krb5-1.*

krb5-1.21-beta1

krb5-1.21-final

krb5-1.21.1-final

krb5-1.21.2-final

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "11.0"
            }
        ]
    },
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "12.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37371.json"