CVE-2011-1529
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka...
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.
Exploit likelihood
What each source reports
NVD Score used
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.
- Record
CVE-2011-1529- CVSS 2.0
- 7.8 High
AV:N/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.
- Record
CVE-2011-1529- Updated
- 2026-11-02
EUVDEUVD-2011-1530 No score
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.
- Record
EUVD-2011-1530- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-54mf-f57f-83fj No score
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka...
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.
- Record
GHSA-54mf-f57f-83fj- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.
- Record
CVE-2011-1529- Updated
- 2026-11-02
OSVDEBIAN-CVE-2011-1529 No score
The lookup_lockout_policy function in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) 1.8 through 1.8.4 and 1.9 through 1.9.1, when the db2 (aka Berkeley DB) or LDAP back end is used, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via vectors that trigger certain process_as_req errors.
- Record
DEBIAN-CVE-2011-1529- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10004-1 No score
krb5-1.15-1.1 on GA media
These are all security issues fixed in the krb5-1.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10004-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5Debian:12 |
before 1.10+dfsg~alpha1-1 | 1.10+dfsg~alpha1-1 |
krb5Debian:13 |
before 1.10+dfsg~alpha1-1 | 1.10+dfsg~alpha1-1 |
krb5Debian:14 |
before 1.10+dfsg~alpha1-1 | 1.10+dfsg~alpha1-1 |
krb5Debian:6.0 |
before 1.8.3+dfsg-4squeeze5, plus listed versions 1.8.3+dfsg-41.8.3+dfsg-4squeeze11.8.3+dfsg-4squeeze2 |
1.8.3+dfsg-4squeeze5 |
krb5Red Hat:enterprise_linux:6::server |
before 0:1.9-9.el6_1.2 | 0:1.9-9.el6_1.2 |
krb5-debuginfoRed Hat:enterprise_linux:6::server |
before 0:1.9-9.el6_1.2 | 0:1.9-9.el6_1.2 |
krb5-develRed Hat:enterprise_linux:6::server |
before 0:1.9-9.el6_1.2 | 0:1.9-9.el6_1.2 |
krb5-libsRed Hat:enterprise_linux:6::server |
before 0:1.9-9.el6_1.2 | 0:1.9-9.el6_1.2 |
krb5-pkinit-opensslRed Hat:enterprise_linux:6::server |
before 0:1.9-9.el6_1.2 | 0:1.9-9.el6_1.2 |
krb5-serverRed Hat:enterprise_linux:6::server |
before 0:1.9-9.el6_1.2 | 0:1.9-9.el6_1.2 |
krb5-server-ldapRed Hat:enterprise_linux:6::server |
before 0:1.9-9.el6_1.2 | 0:1.9-9.el6_1.2 |
krb5-workstationRed Hat:enterprise_linux:6::server |
before 0:1.9-9.el6_1.2 | 0:1.9-9.el6_1.2 |
krb5openSUSE:Tumbleweed |
before 1.15-1.1 | 1.15-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-1529 is a high vulnerability (CVSS 7.8) in Mit Kerberos 5, published October 20, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.05%, the 90th percentile. Fixed in krb5 1.10+dfsg~alpha1-1.
References
mandriva.com/security/advisories?name=MDVSA-2011:159
lists.opensuse.org/opensuse-security-announce/2011-10/msg00009.html
kb.cert.org/vuls/id/659251
web.mit.edu/kerberos/advisories/MITKRB5-SA-2011-006.txt
redhat.com/support/errata/RHSA-2011-1379.html
Show 69 moreShow less
nvd.nist.gov/vuln/detail/CVE-2011-1529
github.com/advisories/GHSA-54mf-f57f-83fj
security-tracker.debian.org/tracker/CVE-2011-1529
access.redhat.com/errata/RHSA-2011:1379
bugzilla.redhat.com/show_bug.cgi?id=737711
security.access.redhat.com/data/csaf/v2/advisories/2011/rhsa-2011_1379.json
cve.org/CVERecord?id=CVE-2011-1527
suse.com/security/cve/CVE-2002-2443