In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
21 Nov 2024, 04:22
Type | Values Removed | Values Added |
---|---|---|
References | () http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.html - Mailing List, Third Party Advisory | |
References | () http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.html - Mailing List, Third Party Advisory | |
References | () http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html - Mailing List, Third Party Advisory | |
References | () http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html - Patch, Vendor Advisory | |
References | () https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf - Patch, Third Party Advisory | |
References | () https://github.com/heimdal/heimdal/compare/3e58559...bbafe72 - Patch, Third Party Advisory | |
References | () https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0 - Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIXEDVVMPD6ZAJSMI2EZ7FNEIVNWE5PD/ - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLXXIF4LOQEAEDAF4UGP2AO6WDNTDFUB/ - | |
References | () https://seclists.org/bugtraq/2019/Jun/1 - Mailing List, Third Party Advisory | |
References | () https://www.debian.org/security/2019/dsa-4455 - Third Party Advisory |
07 Nov 2023, 03:03
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2019-05-15 23:29
Updated : 2024-11-21 04:22
NVD link : CVE-2019-12098
Mitre link : CVE-2019-12098
CVE.ORG link : CVE-2019-12098
JSON object : View
Products Affected
opensuse
- backports_sle
- leap
debian
- debian_linux
heimdal_project
- heimdal
fedoraproject
- fedora
CWE