Uncontrolled Recursion in Kerberos 5 - CVE-2020-28196

Vulnerability identifier: #VU48444

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-28196

CWE-ID: CWE-674

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to uncontrolled recursion in MIT Kerberos 5 (aka krb5) implementation when processing ASN.1-encoded Kerberos messages in lib/krb5/asn.1/asn1_encode.c. A remote attacker can pass specially crafted data to the application that uses Kerberos and perform a denial of service (DoS) attack.

Kerberos 5
Gentoo Linux
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for ARM 64
Oracle Solaris
Ubuntu
openEuler
Fedora
scap-security-guide (Red Hat package)
cockpit-ovirt (Red Hat package)
imgbased (Red Hat package)
krb5 (Alpine package)
redhat-release-virtualization-host (Red Hat package)
krb5-kdc-ldap (Ubuntu package)
libkrad0 (Ubuntu package)
libk5crypto3 (Ubuntu package)
krb5-admin-server (Ubuntu package)
libgssrpc4 (Ubuntu package)
krb5-kdc (Ubuntu package)
libgssapi-krb5-2 (Ubuntu package)
libkdb5-7 (Ubuntu package)
krb5-user (Ubuntu package)
krb5-locales (Ubuntu package)
krb5-pkinit (Ubuntu package)
krb5-multidev (Ubuntu package)
krb5-otp (Ubuntu package)
libkrb5-3 (Ubuntu package)
libkadm5srv-mit8 (Ubuntu package)
libkrb5support0 (Ubuntu package)
libkadm5srv-mit9 (Ubuntu package)
libkadm5clnt-mit9 (Ubuntu package)
libkdb5-8 (Ubuntu package)
krb5-k5tls (Ubuntu package)
libkdb5-9 (Ubuntu package)
libkadm5srv-mit11 (Ubuntu package)
libkadm5clnt-mit11 (Ubuntu package)
krb5-kpropd (Ubuntu package)
krb5 (Debian package)
krb5
krb5-debuginfo
krb5-devel
krb5-debugsource
krb5-help
krb5-client
krb5-libs
krb5-server
krb5 (Red Hat package)
ovirt-hosted-engine-ha (Red Hat package)
redhat-virtualization-host (Red Hat package)
Red Hat OpenShift Serverless
Windows Container Support for Red Hat OpenShift
Red Hat Virtualization
OpenShift Virtualization
Cloud Pak for Security (CP4S)
Oracle Communications Cloud Native Core Policy
Red Hat OpenShift Jaeger
Red Hat Virtualization Host
Web Terminal
RSA Authentication Manager
MySQL Server
IBM Security Verify Access
Oracle Communications Offline Mediation Controller
Oracle Communications Pricing Design Center

Install update from vendor's website.

Kerberos 5 - update to 1.18.3
scap-security-guide (Red Hat package) - update to 0.1.54-1.el8ev
cockpit-ovirt (Red Hat package) - update to 0.15.0-2.el8ev
Red Hat OpenShift Serverless - update to 1.16.0
imgbased (Red Hat package) - update to 1.2.19-1.el8ev
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
Windows Container Support for Red Hat OpenShift - update to 2.0.1
redhat-release-virtualization-host (Red Hat package) - update to 4.4.6-1.el8ev
MySQL Server - update to 8.0.24
IBM Security Verify Access - update to 10.0.4.0
Web Terminal - update to 1.3
krb5-kdc-ldap (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libkrad0 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libk5crypto3 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
krb5-admin-server (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libgssrpc4 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
krb5-kdc (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libgssapi-krb5-2 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libkdb5-7 (Ubuntu package) - update to 1.12+dfsg-2ubuntu5.4+esm2
krb5-user (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
krb5-locales (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
krb5-pkinit (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
krb5-multidev (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
krb5-otp (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libkrb5-3 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libkadm5srv-mit8 (Ubuntu package) - update to 1.12+dfsg-2ubuntu5.4+esm2
libkrb5support0 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libkadm5srv-mit9 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2
libkadm5clnt-mit9 (Ubuntu package) - addressed in versions 1.12+dfsg-2ubuntu5.4+esm2, 1.13.2+dfsg-5ubuntu2.2
libkdb5-8 (Ubuntu package) - update to 1.13.2+dfsg-5ubuntu2.2
krb5-k5tls (Ubuntu package) - addressed in versions 1.13.2+dfsg-5ubuntu2.2, 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libkdb5-9 (Ubuntu package) - addressed in versions 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libkadm5srv-mit11 (Ubuntu package) - addressed in versions 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
libkadm5clnt-mit11 (Ubuntu package) - addressed in versions 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
krb5-kpropd (Ubuntu package) - addressed in versions 1.16-2ubuntu0.2, 1.17-6ubuntu4.1, 1.17-10ubuntu0.1
krb5 (Debian package) - update to 1.17-3+deb10u1
krb5 - addressed in versions 1.17-47.fc31, 1.18.2-29.fc32, 1.18.2-29.fc33
krb5 - update to 1.18.2-2
krb5-debuginfo - update to 1.18.2-2
krb5-devel - update to 1.18.2-2
krb5-debugsource - update to 1.18.2-2
krb5-help - update to 1.18.2-2
krb5-client - update to 1.18.2-2
krb5-libs - update to 1.18.2-2
krb5-server - update to 1.18.2-2
krb5 (Red Hat package) - update to 1.18.2-8.el8
ovirt-hosted-engine-ha (Red Hat package) - update to 2.4.7-1.el8ev
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
redhat-virtualization-host (Red Hat package) - update to 4.4.6-20210527.3.el8_4
RSA Authentication Manager - update to 8.5 Patch 3

• https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd
• https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/
• https://security.gentoo.org/glsa/202011-17

• Denial of service in MIT Kerberos 5
• Gentoo update for MIT Kerberos 5
• Debian update for krb5
• Uncontrolled Recursion in krb5 (Alpine package)
• Multiple vulnerabilities in MySQL Server
• Red Hat Enterprise Linux 8 update for krb5
• Multiple vulnerabilities in Red Hat Virtualization for RHEL 8
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in Windows Container Support for Red Hat OpenShift
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in OpenShift Serverless
• Multiple vulnerabilities in Oracle Communications Pricing Design Center
• Multiple vulnerabilities in Oracle Communications Offline Mediation Controller
• Multiple vulnerabilities in Red Hat Web Terminal
• Multiple vulnerabilities in Oracle Communications Cloud Native Core Policy
• Multiple vulnerabilities in IBM Security Verify Access
• Multiple vulnerabilities in IBM Cloud Pak for Security
• Oracle Solaris update for third-party software
• openEuler update for krb5
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Ubuntu update for krb5
• Fedora 31 update for krb5
• Fedora 33 update for krb5
• Fedora 32 update for krb5
• RSA Authentication Manager update for third-party components