CVE-2025-3576

MEDIUM

MIT Kerberos - Info Disclosure

Title source: llm

Description

A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.

References (15)

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:11487

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:13664

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:13777

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:15000

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:15001

[Various Sources] https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html

[Mailing List] https://lists.debian.org/debian-lts-announce/2025/05/msg00047.html

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:15002

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:15003

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:15004

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:8411

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:9418

[Vendor Advisory] https://access.redhat.com/errata/RHSA-2025:9430

[Vendor Advisory] https://access.redhat.com/security/cve/CVE-2025-3576

[Issue Tracking] https://bugzilla.redhat.com/show_bug.cgi?id=2359465

Scores

CVSS v3 5.9

EPSS 0.0023

EPSS Percentile 45.7%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Classification

CWE

CWE-328

Status draft

Timeline

Published Apr 15, 2025

Tracked Since Feb 18, 2026