Description
MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN containership check by supplying both a "linkdn" and "containerdn" database argument, or by supplying a DN string which is a left extension of a container DN string but is not hierarchically within the container DN.
Scores
CVSS v3
3.8
EPSS
0.0043
EPSS Percentile
62.3%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N
Details
CWE
CWE-90
Status
published
Products (8)
debian/debian_linux
8.0
debian/debian_linux
9.0
fedoraproject/fedora
26
fedoraproject/fedora
27
mit/kerberos_5
5-1.6 - 5-1.21.2
redhat/enterprise_linux_desktop
7.0
redhat/enterprise_linux_server
7.0
redhat/enterprise_linux_workstation
7.0
Published
Mar 06, 2018
Tracked Since
Feb 18, 2026