UBUNTU-CVE-2017-15088

    Dashboard / Vulnerabilities / UBUNTU-CVE-2017-15088

    UBUNTU-CVE-2017-15088

    Published: 23 Nov 2017Last Modified: 22 Apr 2026
    Upstream:
    CVE-2017-15088

    Summary:

    Details: plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.

    References: https://ubuntu.com/security/CVE-2017-15088, https://github.com/krb5/krb5/pull/707, https://www.cve.org/CVERecord?id=CVE-2017-15088

    Affected packages

    Package

    Name: krb5

    Purl: pkg:deb/ubuntu/[email protected]+dfsg-2ubuntu5.4+esm7?arch=source&distro=esm-infra-legacy/trusty

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    1.10.1+dfsg-6.1ubuntu1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High