6.5
CVE-2023-36054
- EPSS 0.65%
- Published 07.08.2023 19:15:09
- Last modified 21.11.2024 08:09:15
- Source cve@mitre.org
- Teams watchlist Login
- Open Login
lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.
Data is provided by the National Vulnerability Database (NVD)
Mit ≫ Kerberos 5 Version < 1.20.2
Mit ≫ Kerberos 5 Version1.21 Update-
Mit ≫ Kerberos 5 Version1.21 Updatebeta1
Debian ≫ Debian Linux Version10.0
Netapp ≫ Active Iq Unified Manager Version- SwPlatformvmware_vsphere
Netapp ≫ Clustered Data Ontap Version9.0 Update-
Netapp ≫ Management Services For Element Software Version-
Netapp ≫ Ontap Tools Version- SwPlatformvmware_vsphere
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.65% | 0.698 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 6.5 | 2.8 | 3.6 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
|
CWE-824 Access of Uninitialized Pointer
The product accesses or uses a pointer that has not been initialized.