CVE-2019-25018
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access...
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
- Record
CVE-2019-25018- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
- Record
CVE-2019-25018- Updated
- 2026-11-02
EUVDEUVD-2019-11471 No score
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
- Record
EUVD-2019-11471- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-xxwg-wfjg-vgjp No score
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access...
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
- Record
GHSA-xxwg-wfjg-vgjp- Weakness
- CWE-863
- Updated
- 2026-11-02
OSV
In the rcp client in MIT krb5-appl through 1.0.3, malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side. NOTE: MIT krb5-appl is not supported upstream but is shipped by a few Linux distributions. The affected code was removed from the supported MIT Kerberos 5 (aka krb5) product many years ago, at version 1.8.
- Record
CVE-2019-25018- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2021-0196 No score
Updated krb5-appl packages fix security vulnerabilities
An issue was discovered in rcp in MIT krb5-appl through 1.0.3. Due to the rcp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. However, the rcp client only performs cursory validation of the object name returned (only directory traversal attacks are prevented). A malicious rcp server (or Man-in-The-Middle attacker) can overwrite arbitrary files in the rcp client target directory. If recursive operation (-r) is performed, the server can manipulate subdirectories as well (for example, to overwrite the .ssh/authorized_keys file). This issue is similar to CVE-2019-6111 and CVE-2019-7283 (CVE-2019-25017).
In the rcp client in MIT krb5-appl through 1.0.3 malicious servers could bypass intended access restrictions via the filename of . or an empty filename, similar to CVE-2018-20685 and CVE-2019-7282. The impact is modifying the permissions of the target directory on the client side (CVE-2019-25018).
- Record
MGASA-2021-0196- Updated
- 2026-11-02
OSVSUSE-SU-2021:0527-1 No score
Security update for krb5-appl
This update for krb5-appl fixes the following issues:
- CVE-2019-25017: Check the filenames sent by the server match those requested by the client (bsc#1131109).
- CVE-2019-25018: Disallow empty incoming filename or ones that refer to the current directory (bsc#1131109).
- Record
SUSE-SU-2021:0527-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
krb5-applMageia:7 |
before 1.0.3-10.2.mga7 | 1.0.3-10.2.mga7 |
krb5-applMageia:8 |
before 1.0.3-13.1.mga8 | 1.0.3-13.1.mga8 |
krb5-applSUSE:HPE Helion OpenStack 8 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:OpenStack Cloud 7 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:OpenStack Cloud 8 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:OpenStack Cloud 9 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:OpenStack Cloud Crowbar 8 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:OpenStack Cloud Crowbar 9 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server for SAP Applications 12 SP2 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server for SAP Applications 12 SP3 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
krb5-applSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server 12 SP2-LTSS |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server 12 SP2-BCL |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server 12 SP3-LTSS |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server 12 SP3-BCL |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server 12 SP4-LTSS |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server 12 SP5 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
krb5-applSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 1.0.3-3.6.1 | 1.0.3-3.6.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-25018 is a high vulnerability (CVSS 7.5) in Mit Krb5-appl, published February 2, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in krb5-appl 1.0.3-10.2.mga7.