CVE-2023-39975

    Dashboard / Vulnerabilities / CVE-2023-39975

    CVE-2023-39975

    Published: 16 Aug 2023Last Modified: 12 Aug 2026

    Summary:

    Details: kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.

    References: https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final, https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39975.json, https://nvd.nist.gov/vuln/detail/CVE-2023-39975, https://security.netapp.com/advisory/ntap-20230915-0014/, https://security.netapp.com/advisory/ntap-20240201-0005/, https://security.netapp.com/advisory/ntap-20240201-0008/, https://web.mit.edu/kerberos/www/advisories/, https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 7efe9fc3551f0e1368fb6b7832161ebad942ed72
    Fixed -835f6e3d819beb7ee1046f01afb284b54ad54c5f

    Affected versions

    krb5-1.21.1-final

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2023-39975 | CVE-DB