CVE-2019-12098

HIGH EPSS 78.1%

Published May 15, 20197y ago · Modified Jun 17, 20262w ago

7.4 CVSS 3.1

High

Published May 15, 2019 7y ago

Last Modified Jun 17, 2026 2w ago

Description

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

CVSS Details

Base Score

7.4

Exploitability

2.2

Impact

5.2

Vector string

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector Network

Attack Complexity High

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality High

Integrity High

Availability None

Threat Intelligence

EPSS Exploit Probability

78.1% percentile

Exploit & Patch Status

No Known Exploit

Patch Available

Weaknesses 1

CWE-295

Affected Products 9

Vendor	Product	Version	Range
heimdal_project	heimdal	*	<7.6.0
fedoraproject	fedora	30	any
fedoraproject	fedora	31	any
opensuse	backports_sle	15.0	any
opensuse	backports_sle	15.0	any
opensuse	leap	15.0	any
opensuse	leap	15.1	any
opensuse	leap	42.3	any
debian	debian_linux	9.0	any

References 11

lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.html

Mailing ListThird Party Advisory
lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.html

Mailing ListThird Party Advisory
lists.opensuse.org http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.html

Mailing ListThird Party Advisory
h5l.org http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html

PatchVendor Advisory
github.com https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf

PatchThird Party Advisory
github.com https://github.com/heimdal/heimdal/compare/3e58559...bbafe72

PatchThird Party Advisory
github.com https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0

Third Party Advisory
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIXEDVVMPD6ZAJSMI2EZ7FNEIVNWE5PD/
lists.fedoraproject.org https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLXXIF4LOQEAEDAF4UGP2AO6WDNTDFUB/
seclists.org https://seclists.org/bugtraq/2019/Jun/1

Mailing ListThird Party Advisory
debian.org https://www.debian.org/security/2019/dsa-4455

Third Party Advisory

Remediation

h5l.org http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html

PatchVendor Advisory
github.com https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cf

PatchThird Party Advisory
github.com https://github.com/heimdal/heimdal/compare/3e58559...bbafe72

PatchThird Party Advisory