CVE Vulnerability

CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

5.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 4.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

Scope

7.4 /10

CVSS v3.0 : HIGH

V3 Legend

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0 Third Party Advisory
https://github.com/heimdal/heimdal/compare/3e58559...bbafe72 Patch Third Party Advisory
https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf Patch Third Party Advisory
http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html Patch Vendor Advisory
https://seclists.org/bugtraq/2019/Jun/1 Mailing List Third Party Advisory
https://www.debian.org/security/2019/dsa-4455 Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GIXEDVVMPD6ZAJSMI2EZ7FNEIVNWE5PD/ Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SLXXIF4LOQEAEDAF4UGP2AO6WDNTDFUB/ Mailing List Third Party Advisory
Configurations

Configuration 1

cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:42.3:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*
cpe:2.3:a:opensuse:backports_sle:15.0:-:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Information

Published : 2019-05-15 11:29

Updated : 2022-04-22 08:10

NVD link : CVE-2019-12098

Mitre link : CVE-2019-12098

Products Affected
No products.
CWE
NVD-CWE-noinfo