decode_sequence_of() in lib/krb5/asn.1/asn1_encode.c in MIT Kerberos 5 (aka krb5) 1.11 and later grows the decoded element array one entry at a time, which allows remote attackers to cause a denial of service (CPU consumption in the KDC) by sending an unauthenticated AS-REQ or TGS-REQ with a large number of elements in a SEQUENCE OF field over TCP.
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
| Vendor | Product | Versions | |
|---|---|---|---|
| enterprise linux | 9 | — | |
| Red Hat | Red Hat Enterprise Linux 10 | all versions | |
| Red Hat | Red Hat Enterprise Linux 10.2 Extended Update Support | all versions | |
| Red Hat | Red Hat Enterprise Linux 6 | — | |
| Red Hat | Red Hat Enterprise Linux 7 | all versions | |
| Red Hat | Red Hat Enterprise Linux 8 | all versions | |
| Red Hat | Red Hat Enterprise Linux 9 | all versions | |
| Red Hat | Red Hat Enterprise Linux 9.8 Extended Update Support | all versions | |
| Red Hat | Red Hat Hardened Images | all versions | |
| rhel eus | 9.8 | — |
Our free, open-source honeypot sensor waits on ports your server does not use and reports the scanners and attackers that connect to a shared blocklist.
