{"id":"CVE-2021-37370","aliases":["CLSA-2024-1727287657","CLSA-2024-1727288271"],"status":"published","title":"Fix CVE(s): CVE-2021-37370, CVE-2021-37371, CVE-2024-37370, CVE-2024-37371","description":"* SECURITY UPDATE: fix GSS vulnerabilities\n     - debian/patches/CVE-2021-37370.patch: prevent modification of Extra\n       Count field in GSS krb5 wrap CFX wrap token to avoid appearing\n       truncated to application header\n     - debian/patches/CVE-2021-37371.patch: fix invalid memory reads\n       during GSS message token handling\n     - CVE-2024-37370\n     - CVE-2024-37371","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"published":"2024-09-25T18:07:40Z","modified":"2026-06-04T10:04:11Z","affected":[{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-admin-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-gss-samples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-k5tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-kdc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-kdc-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-locales","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-multidev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-otp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"krb5-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libgssapi-krb5-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libgssrpc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libk5crypto3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkadm5clnt-mit9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkadm5srv-mit9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkdb5-8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrad-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrad0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrb5-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrb5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libkrb5support0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.2+dfsg-5ubuntu2.2+tuxcare.els4"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-admin-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-gss-samples","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-k5tls","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-kdc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-kdc-ldap","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-kpropd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-locales","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-multidev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-otp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-pkinit","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"krb5-user","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgssapi-krb5-2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libgssrpc4","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libk5crypto3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkadm5clnt-mit11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkadm5srv-mit11","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkdb5-9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrad-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrad0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrb5-3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrb5-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libkrb5support0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16-2ubuntu0.4+tuxcare.els2"}]}],"bundled":4}],"references":[{"url":"https://errata.cloudlinux.com/ubuntu16-els/CLSA-2024-1727287657.html","tags":["advisory"]},{"url":"https://errata.cloudlinux.com/ubuntu18-els/CLSA-2024-1727288271.html","tags":["advisory"]}],"sources":{"osv":[{"id":"CLSA-2024-1727287657","title":"Fix CVE(s): CVE-2021-37370, CVE-2021-37371, CVE-2024-37370, CVE-2024-37371","description":"   * SECURITY UPDATE: fix GSS vulnerabilities\n     - debian/patches/CVE-2021-37370.patch: prevent modification of Extra\n       Count field in GSS krb5 wrap CFX wrap token to avoid appearing\n       truncated to application header\n     - debian/patches/CVE-2021-37371.patch: fix invalid memory reads\n       during GSS message token handling\n     - CVE-2024-37370\n     - CVE-2024-37371","status":"published","published":"2024-09-25T18:07:40Z","modified":"2026-06-04T10:04:11.844482Z","updated_at":"2026-11-02T15:43:41.281406Z"},{"id":"CLSA-2024-1727288271","title":"Fix CVE(s): CVE-2021-37370, CVE-2021-37371, CVE-2024-37370, CVE-2024-37371","description":"   * SECURITY UPDATE: fix GSS vulnerabilities\n     - debian/patches/CVE-2021-37370.patch: prevent modification of Extra\n       Count field in GSS krb5 wrap CFX wrap token to avoid appearing\n       truncated to application header\n     - debian/patches/CVE-2021-37371.patch: fix invalid memory reads\n       during GSS message token handling\n     - CVE-2024-37370\n     - CVE-2024-37371","status":"published","published":"2024-09-25T18:17:56Z","modified":"2026-06-04T10:04:07.389502Z","updated_at":"2026-11-02T15:43:41.281406Z"}]}}