Yüksek CVSS 7.5
CVE-2020-28196: Kerberos 5: güvenlik açığı
Açıklama (NVD)
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
Özet bilgiler
- Ürün
- Mit Kerberos 5
- CVSS v3.1
- 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - EPSS
- %4,42 (yüzdelik 91)
- CWE
- CWE-674
- Yama
- Mevcut
Etkilenen sürümler
| Ürün | Başlangıç | Bitiş | Düzeltildi |
|---|---|---|---|
| mit-kerberos-5 | — | — | 1.17.2 |
| mit-kerberos-5 | 1.18.0 | — | 1.18.3 |
| fedoraproject-fedora | 31 | 31 | — |
| netapp-active-iq-unified-manager | — | — | — |
| netapp-active-iq-unified-manager | — | — | — |
| netapp-cloud-backup | — | — | — |
| netapp-oncommand-insight | — | — | — |
| netapp-oncommand-workflow-automation | — | — | — |
| netapp-snapcenter | — | — | — |
| oracle-communications-cloud-native-core-policy | 1.14.0 | 1.14.0 | — |
| oracle-communications-offline-mediation-controller | 12.0.0.3.0 | 12.0.0.3.0 | — |
| oracle-communications-pricing-design-center | 12.0.0.3.0 | 12.0.0.3.0 | — |
| oracle-mysql-server | — | 8.0.23 | — |
Kaynaklar
- NVD kaydı
- github.com
- lists.apache.org
- lists.apache.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.gentoo.org
- security.netapp.com
- security.netapp.com
- www.debian.org
- www.oracle.com
- www.oracle.com
- www.oracle.com
- github.com
- lists.apache.org
- lists.apache.org
- lists.debian.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- lists.fedoraproject.org
- security.gentoo.org
- security.netapp.com
- security.netapp.com
- CWE-674