CVE-2024-37371

Critical

Published: 28/06/2024(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

In MIT Kerberos 5 before version 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.

Risk Assessment

This vulnerability may lead to unexpected application behavior and potential disclosure of sensitive data, posing a security threat to the system.

Recommendation

It is recommended to upgrade to version 1.21.3 or later to mitigate the risks associated with this vulnerability.

Original NVD description (English source)

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.