Input validation error in Kerberos 5 - CVE-2024-37370

Vulnerability identifier: #VU93518

CSH Severity: Medium

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green

CVE-ID: CVE-2024-37370

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Affected software:
Kerberos 5
Migration Toolkit for Containers
Red Hat OpenShift Container Platform
IBM DataPower Gateway
PowerStore 7000X
PowerStore 1000X
PowerStore 3000X
PowerStore 5000X
PowerStore 9000X
SmartFabric Storage Software
PowerStoreX OS
Oracle Linux
Debian Linux
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Linux Enterprise Server 12
SUSE Linux Enterprise High Performance Computing 12
SUSE Linux Enterprise Software Development Kit 12
SUSE Linux Enterprise Server for SAP Applications 12
PowerSC
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE Linux Enterprise Micro
SUSE Linux Enterprise Micro for Rancher
Anolis OS
SUSE Enterprise Storage
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux Server - TUS
Ubuntu
SUSE Linux Enterprise Server 15 SP2 LTSS
SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS
SUSE Linux Enterprise Server 15 SP3 LTSS
SUSE Linux Enterprise Desktop 15 SP4 LTSS
SUSE Linux Enterprise Server 15 SP4 LTSS
Server Applications Module
Basesystem Module
openSUSE Leap
openEuler
Fedora
IBM Concert Software
IBM Cloud Transformation Advisor
Cryostat
Splunk User Behavior Analytics (UBA)
Cluster Observability Operator
Service Interconnect
Run Once Duration Override Operator for Red Hat OpenShift
Migration Toolkit for Runtimes
IBM MQ Operator
Migration Toolkit for Virtualization
Red Hat Advanced Cluster Management for Kubernetes
Custom Metrics Autoscaler Operator for Red Hat OpenShift
Red Hat OpenShift distributed tracing (RHOSDT)
Red Hat OpenShift Dev Spaces
Red Hat Advanced Cluster Security for Kubernetes
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
App Connect Enterprise Certified Container
Kube Descheduler Operator for Red Hat OpenShift
OpenShift Logging
Dell Secure Connect Gateway
Session Smart Router
IBM Power Hardware Management Console (HMC)
IBM Cloud Pak for Business Automation
IBM Observability with Instana
Astronomer with IBM
Guardium Data Security Center (GDSC)
DataStage on Cloud Pak for Data
IBM Business Automation Manager Open Editions
webMethods Managed File Transfer
Dell Data Protection Central
APEX Cloud Platform for Microsoft Azure
PowerStore T
Enterprise SONiC
IBM Cloud Pak for Watson AIOps
watsonx Assistant for IBM Cloud Pak for Data
IBM QRadar Incident Forensics
EMC Cloud Tiering Appliance
Robotic Process Automation for Cloud Pak
System Storage DS8900F
IBM Qradar SIEM
Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions
libkrb5-3 (Ubuntu package)
libkdb5-9 (Ubuntu package)
libkadm5clnt-mit9 (Ubuntu package)
libkadm5srv-mit9 (Ubuntu package)
libkdb5-8 (Ubuntu package)
libkadm5srv-mit8 (Ubuntu package)
libkdb5-7 (Ubuntu package)
libkadm5srv-mit11 (Ubuntu package)
libkadm5clnt-mit11 (Ubuntu package)
libgssrpc4 (Ubuntu package)
libkrb5support0 (Ubuntu package)
krb5-admin-server (Ubuntu package)
krb5-kdc (Ubuntu package)
libkrad0 (Ubuntu package)
krb5-kdc-ldap (Ubuntu package)
krb5-otp (Ubuntu package)
krb5-pkinit (Ubuntu package)
krb5-user (Ubuntu package)
libgssapi-krb5-2 (Ubuntu package)
libk5crypto3 (Ubuntu package)
krb5 (Red Hat package)
krb5-libs
libkadm5
krb5-workstation
krb5-server-ldap
krb5-server
krb5-devel
krb5-pkinit
krb5-debugsource
krb5
krb5-plugin-preauth-pkinit
krb5-server-debuginfo
krb5-client-debuginfo
krb5-plugin-kdb-ldap
krb5-plugin-preauth-otp
krb5-doc
krb5-plugin-preauth-otp-debuginfo
krb5-plugin-kdb-ldap-debuginfo
krb5-plugin-preauth-pkinit-debuginfo
krb5-debuginfo
krb5-debuginfo-32bit
krb5-client
krb5-32bit
krb5-32bit-debuginfo
krb5 (Debian package)
libkadm5clnt-mit12 (Ubuntu package)
libkadm5srv-mit12 (Ubuntu package)
libkdb5-10 (Ubuntu package)
krb5-help
krb5-64bit
krb5-devel-64bit
krb5-64bit-debuginfo
krb5-devel-32bit
krb5-mini
krb5-mini-devel
krb5-mini-debugsource
krb5-plugin-preauth-spake-debuginfo
krb5-plugin-preauth-spake
krb5-mini-debuginfo
libkdb5-10t64 (Ubuntu package)
libgssrpc4t64 (Ubuntu package)
krb5-tests
RSA Authentication Manager
IBM Application Gateway
Red Hat OpenShift Serverless
Multicluster Engine for Kubernetes
OpenShift Data Foundation (formerly OpenShift Container Storage)
OpenShift Virtualization
OpenShift Container Platform for Windows Containers
Network Observability plugin for the Openshift Console
Red Hat OpenShift GitOps
Red Hat Single Sign-On
IBM Security Verify Access
IBM DS8000 Hardware Management Console
IBM CICS TX Advanced
IBM Security Guardium

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

Install updates from vendor's website.

• https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
• https://mailman.mit.edu/pipermail/kerberos-announce/2024q2/000207.html