{"id":"CVE-2017-15088","aliases":["ALPINE-CVE-2017-15088","BELL-CVE-2017-15088","DEBIAN-CVE-2017-15088","EUVD-2017-6557","GHSA-3jq7-j743-cxfp","MGASA-2017-0420","SUSE-SU-2017:2948-1","UBUNTU-CVE-2017-15088"],"status":"published","title":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2...","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.08634,"percentile":0.9514,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-121"],"published":"2017-11-08T07:47:55Z","modified":"2026-10-24T14:19:46Z","fixes":[{"ecosystem":"Alpine:v3.10","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.11","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.12","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.7","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.8","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.9","package":"krb5","fixed_in":["1.15.3-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"krb5","fixed_in":["1.15.2-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"krb5","fixed_in":["1.15.2-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"krb5","fixed_in":["1.15.2-2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"krb5","fixed_in":["1.12.5-40.16.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"krb5","fixed_in":["1.13.2+dfsg-5ubuntu2.2+esm3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.10","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.11","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.7","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.8","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.9","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.3-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.2-2"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-1.3.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-2.2.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for Raspberry Pi 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP2","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-40.16.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.10.1+dfsg-6.1ubuntu1","1.11.3+dfsg-3ubuntu2","1.12+dfsg-2ubuntu1","1.12+dfsg-2ubuntu2","1.12+dfsg-2ubuntu3","1.12+dfsg-2ubuntu4","1.12+dfsg-2ubuntu4.2","1.12+dfsg-2ubuntu5","1.12+dfsg-2ubuntu5.1","1.12+dfsg-2ubuntu5.2","1.12+dfsg-2ubuntu5.3","1.12+dfsg-2ubuntu5.4","1.12+dfsg-2ubuntu5.4+esm1","1.12+dfsg-2ubuntu5.4+esm2","1.12+dfsg-2ubuntu5.4+esm3","1.12+dfsg-2ubuntu5.4+esm4","1.12+dfsg-2ubuntu5.4+esm5","1.12+dfsg-2ubuntu5.4+esm6","1.12+dfsg-2ubuntu5.4+esm7"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+esm3"}]}],"versions":["1.13.2+dfsg-2","1.13.2+dfsg-3","1.13.2+dfsg-4","1.13.2+dfsg-5","1.13.2+dfsg-5ubuntu1","1.13.2+dfsg-5ubuntu2","1.13.2+dfsg-5ubuntu2.1","1.13.2+dfsg-5ubuntu2.1+esm1","1.13.2+dfsg-5ubuntu2.2"]}],"products":[{"vendor":"mit","product":"kerberos_5"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1504045","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871698","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://github.com/krb5/krb5/commit/fbb687db1088ddd894d975996e5f6a4252b9a2b4","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/krb5/krb5/pull/707","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"http://www.securityfocus.com/bid/101594","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-15088"},{"url":"https://github.com/advisories/GHSA-3jq7-j743-cxfp"},{"url":"https://security.alpinelinux.org/vuln/CVE-2017-15088","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2017-15088","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-15088","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0420.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21628","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2XIPFDWKYB3HQKSWLVJ6AAPFEG6BEPE3/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-11/msg00039.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172948-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1065274","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15088","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2017-15088","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-15088","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-15088","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","status":"published","published":"2017-11-23T17:00:00Z","modified":"2024-08-05T19:42:22.305Z","cwes":["CWE-121"],"updated_at":"2026-11-02T14:33:14.556599Z"}],"euvd":[{"id":"EUVD-2017-6557","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","status":"published","published":"2017-11-23T17:00:00Z","modified":"2024-08-05T19:42:22Z","updated_at":"2026-11-03T02:23:15.298105Z"}],"ghsa":[{"id":"GHSA-3jq7-j743-cxfp","title":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2...","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","status":"published","published":"2022-05-13T01:11:53Z","modified":"2025-04-20T03:50:07Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-119","CWE-121"],"updated_at":"2026-11-02T15:01:56.152144Z"}],"nvd":[{"id":"CVE-2017-15088","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","status":"published","published":"2017-11-23T17:29:00.353Z","modified":"2026-06-17T01:07:13.567Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-121","CWE-119"],"updated_at":"2026-11-02T14:04:09.7374Z"}],"osv":[{"id":"ALPINE-CVE-2017-15088","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","status":"published","published":"2017-11-23T17:29:00.353Z","modified":"2026-06-15T18:18:06.781802163Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:27:46.716249Z"},{"id":"BELL-CVE-2017-15088","title":"CVE-2017-15088 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:16:03.14349Z","modified":"2026-01-26T09:49:11.71259Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:28:14.137943Z"},{"id":"CVE-2017-15088","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","status":"published","published":"2017-11-23T17:29:00.353Z","modified":"2026-10-24T14:19:46.387972197Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:04.572713Z"},{"id":"DEBIAN-CVE-2017-15088","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","status":"published","published":"2017-11-23T17:29:00.353Z","modified":"2026-09-01T20:03:44.363194467Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:28.801885Z"},{"id":"UBUNTU-CVE-2017-15088","description":"plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.","status":"published","published":"2017-11-23T17:29:00Z","modified":"2026-04-22T11:16:52.731469Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:54:14.563448Z"},{"id":"MGASA-2017-0420","title":"Updated krb5 packages fix security vulnerabilities","description":"An authentication bypass flaw was found in the way krb5's certauth\ninterface handled the validation of client certificates. A remote\nattacker able to communicate with the KDC could potentially use this\nflaw to impersonate arbitrary principals under rare and erroneous\ncircumstances (CVE-2017-7562).\nNote that this issue only affects Mageia 6.\n\nRFC 2744 permits a GSS-API implementation to delete an existing security\ncontext on a second or subsequent call to gss_init_sec_context() or\ngss_accept_sec_context() if the call results in an error.  This API\nbehavior has been found to be dangerous, leading to the possibility of\nmemory errors in some callers.  For safety, GSS-API implementations\nshould instead preserve existing security contexts on error until the\ncaller deletes them (CVE-2017-11462).\n\nA buffer overflow vulnerability was found in get_matching_data()\nfunction when both the CA cert and the user cert have a long subject\naffecting krb5 that includes certauth plugin. Attack requires a\nvalidated certificate with a long subject and issuer, and a\n\"pkinit_cert_match\" string attribute on some principal in the database.\nA remote code execution exploit might also require that the attacker\ngets to choose the contents of the issuer in the validated cert\n(CVE-2017-15088).\n","status":"published","published":"2017-11-20T21:18:02Z","modified":"2026-04-16T06:23:47.043309473Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2017:2948-1","title":"Security update for krb5","description":"This update for krb5 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2017-15088: A buffer overflow in get_matching_data() was fixed that could under specific circumstances be used to execute code (bsc#1065274)\n","status":"published","published":"2017-11-08T07:47:55Z","modified":"2026-02-04T04:20:16.709334Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}