USN-5959-1: Kerberos vulnerabilities

Releases

• Ubuntu 20.04 LTS
• Ubuntu 18.04 ESM

Packages

• krb5 - MIT Kerberos Network Authentication Protocol

Details

It was discovered that Kerberos incorrectly handled memory when processing
KDC data, which could lead to a NULL pointer dereference. An attacker could
possibly use this issue to cause a denial of service or have other
unspecified impacts. (CVE-2021-36222, CVE-2021-37750)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 20.04

• krb5-pkinit - 1.17-6ubuntu4.3
• krb5-kdc-ldap - 1.17-6ubuntu4.3
• krb5-kdc - 1.17-6ubuntu4.3
• krb5-k5tls - 1.17-6ubuntu4.3

Ubuntu 18.04

• krb5-pkinit - 1.16-2ubuntu0.4
• krb5-kdc-ldap - 1.16-2ubuntu0.4
• krb5-kdc - 1.16-2ubuntu0.4
• krb5-k5tls - 1.16-2ubuntu0.4

In general, a standard system update will make all the necessary changes.

References

• CVE-2021-36222
• CVE-2021-37750