CVE-2017-11462

high-risk

Published 2017-09-13

Double free vulnerability in MIT Kerberos 5 (aka krb5) allows attackers to have unspecified impact via vectors involving automatic deletion of security contexts on error.

Do I need to act?

1.1% chance of exploitation in next 30 days

EPSS score — moderate exploit probability

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 9.8/10 Critical

NETWORK / LOW complexity

Affected Products (15)

Kerberos 5

Fedora

Kerberos 5

Fedora

Affected Vendors

Mit Fedoraproject

References (8)

Vendor Advisory http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1488873

Patch https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

Vendor Advisory http://krbdev.mit.edu/rt/Ticket/Display.html?id=8598

Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1488873

Patch https://github.com/krb5/krb5/commit/56f7b1bc95a2a3eeb420e069e7655fb181ade5cf

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro...

/ 100

high-risk

Severity 32/34 · Critical

Exploitability 3/34 · Minimal

Exposure 18/34 · Moderate