Loading story…
Red Hat released updates for two Moderate-severity MIT Kerberos 5 GSS wrap-token vulnerabilities, CVE-2024-37370 and CVE-2024-37371. A network attacker able to modify a valid token in transit can alter its plaintext Extra Count field, causing the receiving application to interpret the unwrapped message as truncated. The resulting handling errors can disrupt application-layer services; CVE-2024-37370 carries a CVSS 3.1 score of 7.5 and may expose authentication-token data, while CVE-2024-37371 is rated 6.5 and is primarily assessed as an availability risk.
The fixes are delivered through Red Hat krb5 advisories including RHSA-2024:5625 for supported RHEL 8.6 ELS, AUS, telecommunications, and SAP update-service offerings, with krb5-1.18.2-16.el8_6.1, and RHSA-2024:5884 for RHEL Server AUS 8.2, with krb5-1.17-19.el8_2.1. Red Hat reported no qualifying standalone mitigation, so administrators should apply the applicable krb5 package updates across affected RHEL systems.
See affected versions and whether adversaries are exploiting it.
13 events from the most recent confirmed update back to the earliest known activity.
Red Hat issued Moderate-severity advisory RHSA-2024:6166 to remediate krb5 GSS message-token vulnerabilities CVE-2024-37370 and CVE-2024-37371 in Red Hat Enterprise Linux 9. The update covered applicable RHEL 9 channels across x86_64, s390x, ppc64le, and aarch64 architectures.
Red Hat updated its RHSA-2024:5625 security advisory for krb5 and the CVE-2024-37370 and CVE-2024-37371 fixes affecting RHEL 8.6 support offerings.
Red Hat issued Moderate-severity advisory RHSA-2024:5643 for RHEL 9.2 supported update channels, remediating krb5 GSS message-token vulnerabilities CVE-2024-37370 and CVE-2024-37371. The update supplied krb5-1.20.1-9.el9_2.1 packages for affected x86_64, aarch64, s390x, and ppc64le deployments.
Red Hat issued RHSA-2024:5312, fixing the two MIT Kerberos GSS message-token handling vulnerabilities, CVE-2024-37370 and CVE-2024-37371, for Red Hat Enterprise Linux 8.
Red Hat issued RHSA-2024:5316 to remediate CVE-2024-37370 and CVE-2024-37371 in krb5 for the Red Hat Enterprise Linux 7.7 Advanced Update Support stream.
Red Hat issued RHSA-2024:5076, providing a krb5 fix for CVE-2024-37370 and CVE-2024-37371 in the Red Hat Enterprise Linux 7 Extended Lifecycle Support stream.
Red Hat issued Moderate-severity advisory RHSA-2024:4743 for RHEL 8.8 extended-support channels, remediating krb5 GSS message-token flaws CVE-2024-37370 and CVE-2024-37371. The advisory provided krb5-1.18.2-26.el8_8.2 packages for affected x86_64, s390x, ppc64le, and aarch64 deployments.
Red Hat issued RHSA-2024:4734 to fix the MIT Kerberos krb5 GSS wrap-token vulnerabilities CVE-2024-37370 and CVE-2024-37371 for specified RHEL 8.4 support streams, including Advanced Mission Critical Update Support, Telecommunications Update Service, and SAP Solutions services.
Patrick Del Bello recorded CVE-2024-37371 and created Fedora tracking bug 2294680. The flaw affects krb5 versions before 1.21.3 and can cause invalid memory reads when malformed GSS message-token length fields are processed.
Red Hat documented that krb5 versions before 1.21.3 allow modification of the plaintext Extra Count field in confidential GSS krb5 wrap tokens, which can make a receiving application treat the unwrapped token as truncated. The issue was fixed upstream in krb5 commit 55fbf435edbe2e92dd8101669b1ce7144bc96fef.
Red Hat issued RHSA-2025:1673, fixing CVE-2024-37371 in the mysql:8.0 component for Red Hat Enterprise Linux 8.
Red Hat issued Moderate-severity advisory RHSA-2024:5884 for RHEL Server AUS 8.2, fixing CVE-2024-37370 and CVE-2024-37371. The advisory supplied krb5 version 1.17-19.el8_2.1 packages for x86_64 and i686 systems.
Red Hat published Moderate-severity advisory RHSA-2024:5625 to remediate CVE-2024-37370 and CVE-2024-37371 in RHEL 8.6 offerings. It supplied updated krb5 packages version 1.18.2-16.el8_6.1 for affected x86_64 and ppc64le environments.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
13 references tracked. Mallory keeps watching after this page renders.
access.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourceaccess.redhat.com
Open sourcebugzilla.redhat.com
Open sourcebugzilla.redhat.com
Open sourceredhat.com
Open sourceredhat.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Red Hat released **Important** security updates for `sssd` to address two vulnerabilities tracked as **CVE-2026-14474** and **CVE-2026-14476** across multiple Red Hat Enterprise Linux versions and support channels, including RHEL 7 ELS, RHEL 8.4/8.6/8.8, RHEL 9.2/9.4/9.6, and RHEL 10, as well as related SAP, AUS, EUS, ELS, and CodeReady Linux Builder offerings. The first flaw affects deployments using `sudo_provider=ldap` or `sudo_provider=ad`: when `ldap_sudo_search_base` is left unset, SSSD searches from the LDAP domain root for `sudoRole` objects, allowing an LDAP principal with write access in any subtree to create a malicious rule that grants arbitrary sudo privileges on every enrolled host. Red Hat said `sudo_provider=ipa` is not affected. The second flaw, **CVE-2026-14476**, stems from unsanitized `gPCFileSysPath` handling in SSSD's Active Directory GPO provider, enabling path traversal through `..` components after backslashes are converted to forward slashes. Red Hat warned that an attacker with AD GPO management access could write files outside the GPO cache as root; on SELinux-enforcing systems this can be used to target `/var/lib/sss/pubconf/krb5.include.d/` and redirect Kerberos KDC configuration for authentication bypass, while systems with SELinux permissive or disabled may face arbitrary root file write. Fixes were shipped through RHSA advisories including **RHSA-2026:41937**, **RHSA-2026:42122**, **RHSA-2026:46482**, and a series of August updates covering older and specialized RHEL channels.
Aug 25, 2026
Red Hat addressed **CVE-2020-36516**, a moderate-severity Linux kernel TCP/IP flaw that can let an off-path attacker inject data into an active TCP session or terminate it. The issue arises from interactions between mixed and hash-based IPID assignment, enabling packet spoofing through IP fragmentation and IPID collisions; successful exploitation requires a complex scenario and is considered more likely on a local network. Red Hat assigned a CVSS v3.1 score of 5.9, while upstream Linux fixed the vulnerability in kernel `5.17-rc2`. The fix was delivered for supported RHEL 8 and RHEL 9 kernel and real-time kernel packages, including through **RHSA-2024:2674** for RHEL 8.6 extended-support channels. That advisory also remediates `CVE-2024-26586` in the mlxsw Spectrum ACL TCAM component and applies across x86_64, s390x, ppc64le, and aarch64 offerings. Organizations should install the applicable kernel errata and reboot affected systems; Red Hat lists no qualifying mitigation, and RHEL 6 and RHEL 7 are outside support scope.
Aug 26, 2026
Red Hat has released **Important** security updates for `gstreamer1-plugins-bad-free` to address two flaws in GStreamer’s `gst-plugins-bad` package: `CVE-2026-59691` and `CVE-2026-59692`. The first bug affects the `rfbsrc` plugin’s bundled `librfb` code, where a malicious RFB/VNC server can trigger a heap out-of-bounds write during Hextile decoding when a 16bpp RGB565 framebuffer is advertised. The second affects the DTLS plugin, where `openssl_verify_callback()` reads an oversized certificate Subject DN into a fixed 2048-byte stack buffer during handshake processing, allowing a remote DTLS peer to crash the client with a crafted certificate. The vulnerabilities were reproduced on GStreamer `1.28.3` and are slated for upstream correction in `1.28.5`, with tracking advisories `GST-SA-2026-0063` and `GST-SA-2026-0062`. Red Hat shipped remediations across multiple supported product lines, including RHEL 7 ELS, RHEL 8, RHEL 8.4/8.6/8.8 specialized channels, and RHEL 9.2 SAP-related offerings, through advisories including `RHSA-2026:47731`, `RHSA-2026:54664`, `RHSA-2026:54665`, `RHSA-2026:54752`, `RHSA-2026:56658`, and `RHSA-2026:56772`. Red Hat’s analysis indicates the DTLS flaw is most likely to result in denial of service rather than code execution, while the `rfbsrc` issue can cause heap corruption and process aborts when connecting to a hostile server.
Sep 4, 2026