{"id":"CVE-2017-7562","aliases":["EUVD-2017-16567","GHSA-vg8p-42hp-9g25","MGASA-2017-0420","RHSA-2018:0666","SUSE-SU-2018:1425-1"],"status":"published","title":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1...","description":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.","severity":{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03178,"percentile":0.88147,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-287","CWE-295"],"published":"2017-11-20T21:18:02Z","modified":"2026-10-24T10:49:29Z","fixes":[{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"krb5","fixed_in":["1.12.1-38.5.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"krb5","fixed_in":["1.12.1-38.5.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"krb5","fixed_in":["1.12.1-38.5.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:5","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.5-1.3.mga5"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:6","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.15.1-2.2.mga6"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"krb5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"krb5-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"krb5-workstation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"libkadm5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"krb5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"krb5-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"krb5-server-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"krb5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"krb5-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"krb5-workstation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"libkadm5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"krb5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"krb5-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"krb5-server-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"krb5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"krb5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"krb5-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"krb5-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"krb5-server-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"krb5-workstation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"libkadm5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"krb5-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"krb5-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"krb5-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"krb5-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"krb5-server-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"krb5-workstation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"libkadm5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.15.1-18.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-38.5.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-38.5.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.12.1-38.5.3"}]}]}],"products":[{"vendor":"mit","product":"kerberos_5"},{"vendor":"mit","product":"krb5"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"}],"references":[{"url":"https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/100511","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/krb5/krb5/pull/694","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://access.redhat.com/errata/RHSA-2018:0666","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627d","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7562","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-7562","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-7562","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1485510","tags":["report"]},{"url":"https://github.com/advisories/GHSA-vg8p-42hp-9g25"},{"url":"https://advisories.mageia.org/MGASA-2017-0420.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=21628","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2XIPFDWKYB3HQKSWLVJ6AAPFEG6BEPE3/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/2FPRUP4YVOEBGEROUYWZFEQ64HTMGNED/","tags":["web"]},{"url":"https://lists.opensuse.org/opensuse-updates/2017-11/msg00039.html","tags":["web"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1431198","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1443388","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1462982","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1472956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1473560","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_0666.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-7562","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2017-11368","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-11368","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-11368","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2018/suse-su-20181425-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1054028","tags":["report"]},{"url":"https://bugzilla.suse.com/1055851","tags":["report"]},{"url":"https://bugzilla.suse.com/1081725","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7562","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2017-7562","description":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.","status":"published","published":"2018-07-26T15:00:00Z","modified":"2024-08-05T16:04:12.058Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-295","CWE-287"],"updated_at":"2026-11-02T14:33:20.843976Z"}],"euvd":[{"id":"EUVD-2017-16567","description":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.","status":"published","published":"2018-07-26T15:00:00Z","modified":"2024-08-05T16:04:12Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-03T02:39:08.024596Z"}],"ghsa":[{"id":"GHSA-vg8p-42hp-9g25","title":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1...","description":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.","status":"published","published":"2022-05-13T01:28:47Z","modified":"2023-02-10T05:06:12Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"cwes":["CWE-287"],"updated_at":"2026-11-02T14:54:01.286462Z"}],"nvd":[{"id":"CVE-2017-7562","description":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.","status":"published","published":"2018-07-26T15:29:00.403Z","modified":"2026-06-17T01:24:37.05Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-287","CWE-295"],"updated_at":"2026-11-02T14:04:18.679411Z"}],"osv":[{"id":"CVE-2017-7562","description":"An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.","status":"published","published":"2018-07-26T15:29:00.403Z","modified":"2026-10-24T10:49:29.944789377Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:06.412595Z"},{"id":"RHSA-2018:0666","title":"Red Hat Security Advisory: krb5 security, bug fix, and enhancement update","status":"published","published":"2024-09-16T00:31:20Z","modified":"2026-08-05T10:05:18Z","cvss":[{"version":"3.0","score":6.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"MGASA-2017-0420","title":"Updated krb5 packages fix security vulnerabilities","description":"An authentication bypass flaw was found in the way krb5's certauth\ninterface handled the validation of client certificates. A remote\nattacker able to communicate with the KDC could potentially use this\nflaw to impersonate arbitrary principals under rare and erroneous\ncircumstances (CVE-2017-7562).\nNote that this issue only affects Mageia 6.\n\nRFC 2744 permits a GSS-API implementation to delete an existing security\ncontext on a second or subsequent call to gss_init_sec_context() or\ngss_accept_sec_context() if the call results in an error.  This API\nbehavior has been found to be dangerous, leading to the possibility of\nmemory errors in some callers.  For safety, GSS-API implementations\nshould instead preserve existing security contexts on error until the\ncaller deletes them (CVE-2017-11462).\n\nA buffer overflow vulnerability was found in get_matching_data()\nfunction when both the CA cert and the user cert have a long subject\naffecting krb5 that includes certauth plugin. Attack requires a\nvalidated certificate with a long subject and issuer, and a\n\"pkinit_cert_match\" string attribute on some principal in the database.\nA remote code execution exploit might also require that the attacker\ngets to choose the contents of the issuer in the validated cert\n(CVE-2017-15088).\n","status":"published","published":"2017-11-20T21:18:02Z","modified":"2026-04-16T06:23:47.043309473Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"SUSE-SU-2018:1425-1","title":"Security update for krb5","description":"This update for krb5 provides the following fixes:\n\nSecurity issues fixed:\n\n- CVE-2017-7562: Improper validation of certificate EKU and SAN could lead to authentication\n  bypass. (bsc#1055851)\n\nNon-security issues fixed:\n\n- Set 'rdns' and 'dns_canonicalize_hostname' to false in krb5.conf in order to improve\n  client security in handling service principle names. (bsc#1054028)\n- Fix a GSS failure in legacy applications by not indicating deprecated GSS mechanisms in\n  gss_indicate_mech() list. (bsc#1081725)\n","status":"published","published":"2018-05-25T13:05:54Z","modified":"2026-02-04T03:25:09.641315Z","updated_at":"2026-11-02T15:53:44.972817Z"}]}}