CVE-2023-36054

—

CVSS 3.1

6.5 medium

EPSS

3%p86

Published

Aug 7, 2023 (Aug 7, 2023)

Modified

Jun 17, 2026

Description

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

Vendors: mit debian netapp
Products: kerberos 5, debian linux, active iq unified manager, clustered data ontap, hci, management services for element software, ontap tools
Weakness: CWE-824
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (2.8%)

In the news0 stories

No ingested article mentions this CVE yet.