CVE-2022-42898

krb5: integer overflow vulnerabilities in PAC parsing

Loading…

Severity

Important

Red Hat Product Security

8.8

CVSS 3.1

Review impact separately from score.

Published · November 15, 2022

Updated · November 21, 2025

Description

A vulnerability was found in MIT krb5. This flaw allows an authenticated attacker to cause a KDC or kadmind process to crash by reading beyond the bounds of allocated memory, creating a denial of service. A privileged attacker may similarly be able to cause a Kerberos or GSS application service to crash.

Statement

Samba in RHEL does not implement the AD DC role and is not built against Heimdal, thus Samba is not affected by this CVE.

CVSS score applicability

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation

No mitigation is specified in collected source.

CVSS / CWE

CVSS 3.1 · 8.8
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-190 · Integer Overflow or Wraparound