CVE-2017-11368

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion...

6.5 MediumFix available

CVE-2017-11368 is a medium vulnerability (CVSS 6.5) in Mit Kerberos, published August 9, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.40%, the 84th percentile. Fixed in krb5 1.15.1-2.

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

2.40%Up 1.2 points since Apr 14, 2021

What each source reports

NVD Score used 6.5

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Record: CVE-2017-11368
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 4.0 MediumAV:N/AC:L/Au:S/C:N/I:N/A:P
Weakness: CWE-617
Updated: 2026-11-02

CVE List No score

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Record: CVE-2017-11368
Updated: 2026-11-02

EUVDEUVD-2017-2995 No score

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Record: EUVD-2017-2995
Updated: 2026-11-03

GitHub AdvisoriesGHSA-8f95-9vr9-hxf2 6.5

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion...

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Record: GHSA-8f95-9vr9-hxf2
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-617
Updated: 2026-11-02

OSV 6.5

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Record: CVE-2017-11368
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2017-11368 6.5

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Record: DEBIAN-CVE-2017-11368
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 4 moreShow less

OSVRHSA-2018:0666 6.5

Red Hat Security Advisory: krb5 security, bug fix, and enhancement update

Record: RHSA-2018:0666
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2017-11368 6.5

In MIT Kerberos 5 (aka krb5) 1.7 and later, an authenticated attacker can cause a KDC assertion failure by sending invalid S4U2Self or S4U2Proxy requests.

Record: UBUNTU-CVE-2017-11368
CVSS 3.0: 6.5 MediumCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2017-0256 No score

Updated krb5 packages fix security vulnerability

A denial of service flaw was found in MIT Kerberos krb5kdc service. An authenticated attacker could use this flaw to cause krb5kdc to exit with an assertion failure by making an invalid S4U2Self or S4U2Proxy request (CVE-2017-11368).

Record: MGASA-2017-0256
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10899-1 No score

krb5-1.19.2-2.2 on GA media

These are all security issues fixed in the krb5-1.19.2-2.2 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10899-1
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`krb5` Debian:12	before 1.15.1-2	1.15.1-2
`krb5` Debian:13	before 1.15.1-2	1.15.1-2
`krb5` Debian:14	before 1.15.1-2	1.15.1-2
`krb5` Debian:7	before 1.10.1+dfsg-5+deb7u8, plus listed versions 1.10.1+dfsg-51.10.1+dfsg-5+deb7u11.10.1+dfsg-5+deb7u21.10.1+dfsg-5+deb7u31.10.1+dfsg-5+deb7u41.10.1+dfsg-5+deb7u51.10.1+dfsg-5+deb7u61.10.1+dfsg-5+deb7u7	1.10.1+dfsg-5+deb7u8
`krb5` Mageia:5	before 1.12.5-1.2.mga5	1.12.5-1.2.mga5
`krb5` Mageia:6	before 1.15.1-2.1.mga6	1.15.1-2.1.mga6
`krb5` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-debuginfo` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-libs` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-pkinit` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7

Show 35 moreShow less

Affected packages
Package	Affected	Fixed
`krb5-workstation` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`libkadm5` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-devel` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-server` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-server-ldap` Red Hat:enterprise_linux:7::client	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-debuginfo` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-libs` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-pkinit` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-workstation` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`libkadm5` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-devel` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-server` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-server-ldap` Red Hat:enterprise_linux:7::computenode	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-debuginfo` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-devel` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-libs` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-pkinit` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-server` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-server-ldap` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-workstation` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`libkadm5` Red Hat:enterprise_linux:7::server	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-debuginfo` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-devel` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-libs` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-pkinit` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-server` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-server-ldap` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5-workstation` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`libkadm5` Red Hat:enterprise_linux:7::workstation	before 0:1.15.1-18.el7	0:1.15.1-18.el7
`krb5` Ubuntu:14.04:LTS	before 1.12+dfsg-2ubuntu5.4, plus listed versions 1.10.1+dfsg-6.1ubuntu11.11.3+dfsg-3ubuntu21.12+dfsg-2ubuntu11.12+dfsg-2ubuntu21.12+dfsg-2ubuntu3 Show 6 moreShow less 1.12+dfsg-2ubuntu41.12+dfsg-2ubuntu4.21.12+dfsg-2ubuntu51.12+dfsg-2ubuntu5.11.12+dfsg-2ubuntu5.21.12+dfsg-2ubuntu5.3	1.12+dfsg-2ubuntu5.4
`krb5` Ubuntu:16.04:LTS	before 1.13.2+dfsg-5ubuntu2.1, plus listed versions 1.13.2+dfsg-21.13.2+dfsg-31.13.2+dfsg-41.13.2+dfsg-51.13.2+dfsg-5ubuntu11.13.2+dfsg-5ubuntu2	1.13.2+dfsg-5ubuntu2.1
`krb5` openSUSE:Tumbleweed	before 1.19.2-2.2	1.19.2-2.2

History

History
When	Changed	Sources
2026-11-03	aliases	EUVD
2026-11-02	created	CVE List, GitHub Advisories, NVD, OSV

References

Show 43 moreShow less