Published: 15/05/2019 Updated: 07/11/2023

CVSS v2 Base Score: 5.8 | Impact Score: 4.9 | Exploitability Score: 8.6

CVSS v3 Base Score: 7.4 | Impact Score: 5.2 | Exploitability Score: 2.2

VMScore: 516

Vector: AV:N/AC:M/Au:N/C:P/I:P/A:N

In the client side of Heimdal prior to 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

Vulnerable Product	Search on Vulmon	Subscribe to Product
heimdal project heimdal
fedoraproject fedora 30
fedoraproject fedora 31
opensuse leap 42.3
opensuse leap 15.0
opensuse leap 15.1
opensuse backports sle 15.0
debian debian linux 9.0

Several security issues were fixed in Heimdal ...

Debian Bug report logs - #928966 heimdal: CVE-2018-16860 Package: src:heimdal; Maintainer for src:heimdal is Brian May <bam@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Tue, 14 May 2019 07:39:02 UTC Severity: important Tags: security, upstream Found in versions heimdal/710+dfsg-13, heim ...

Debian Bug report logs - #929064 heimdal: CVE-2019-12098: krb5: always confirm PA-PKINIT-KX for anon PKINIT Package: src:heimdal; Maintainer for src:heimdal is Brian May <bam@debianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Thu, 16 May 2019 09:06:02 UTC Severity: important Tags: security, upst ...

Several vulnerabilities were discovered in Heimdal, an implementation of Kerberos 5 that aims to be compatible with MIT Kerberos CVE-2018-16860 Isaac Boukris and Andrew Bartlett discovered that Heimdal was susceptible to man-in-the-middle attacks caused by incomplete checksum validation Details on the issue can be found in the Samba ...

NVD-CWE-noinfo https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0 https://github.com/heimdal/heimdal/compare/3e58559...bbafe72 https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html https://seclists.org/bugtraq/2019/Jun/1 https://www.debian.org/security/2019/dsa-4455 http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.html http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.html http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIXEDVVMPD6ZAJSMI2EZ7FNEIVNWE5PD/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLXXIF4LOQEAEDAF4UGP2AO6WDNTDFUB/https://ubuntu.com/security/notices/USN-5675-1 https://nvd.nist.gov

CVE-2019-12098

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect