Loading vulnerability…
Confidential GSS Wrap-Token Truncation in MIT Kerberos 5
MIT Kerberos 5 (krb5) before version 1.21.3 contains a vulnerability in confidential GSS krb5 wrap-token handling. An attacker able to modify a token in transit can alter its plaintext Extra Count field, causing the receiving application to perceive the unwrapped message as truncated. The flaw permits manipulation of the message length presented to the application despite the token's confidentiality protection.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Receiving applications can process a truncated representation of a protected message, potentially mishandling the associated data. The published CVSS v3.1 assessment is 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), assigning high confidentiality impact and no integrity or availability impact. Specific information-disclosure mechanisms or application-dependent consequences are not established.
If you can’t patch tonight, do this now.
No vendor-approved interim workaround is available. Red Hat states that no mitigation meets its product-security usability, deployment, applicability, and stability criteria; installing the applicable security update is the recommended resolution.
Patch, then assume compromise.
Upgrade upstream MIT Kerberos 5 to version 1.21.3 or later, or install the applicable vendor package containing the backported fix. Fixed Red Hat builds include 1.15.1-55.el7_9.2 for RHEL 7 ELS, 1.18.2-29.el8_10 for RHEL 8.10, 1.18.2-26.el8_8.2 for RHEL 8.8 extended-support channels, and 1.20.1-9.el9_2.1 for RHEL 9.2 supported update channels. Update affected libraries and dependent container images as applicable. Verify distribution advisory status rather than relying solely on upstream version comparisons, because vendors backport the fix.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.