[BLFS Trac] #23215: Fix CVE-2026-40355 and CVE-2026-40356 in krb5

#23215: Fix CVE-2026-40355 and CVE-2026-40356 in krb5
-----------------------------+-----------------------
 Reporter:  Douglas R. Reno  |      Owner:  blfs-book
     Type:  enhancement      |     Status:  new
 Priority:  elevated         |  Milestone:  13.1
Component:  BOOK             |    Version:  git
 Severity:  normal           |   Keywords:
-----------------------------+-----------------------
 From oss-security:

 {{{


 Hi,

 just a quick note that MIT krb5 has fixed two unauthenticated network
 NegoEx parsing vulnerabilities.

 Affected versions:

 MIT krb5 1.18 and later, when an application calls
 gss_accept_sec_context() on a system with a NegoEx mechanism registered
 in /etc/gss/mech

 Description:

 CVE-2026-40355 is a null pointer dereference in parse_nego_message().
 The result of the second vector_base() call was not checked before being
 dereferenced. An unauthenticated remote attacker can trigger this issue
 and crash the process.

 CVE-2026-40356 is a read overrun of up to 52 bytes in parse_message().
 A short header_len could cause an integer underflow while calculating the
 remaining message length. An unauthenticated remote attacker can trigger
 this issue and possibly crash the proces.
 Exfiltration of the bytes read appears unlikely.

 MIT krb5 security confirmed the following CVSS v3.1 vectors:

 CVE-2026-40355:
 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
 Base score: 7.5

 CVE-2026-40356:
 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
 Base score: 5.9

 Users are recommended to apply the upstream patch or update to a version
 containing the fix.

 Credit:
 Cem Onat Karagun

 References:
 https://github.com/krb5/krb5/commit/2e75f0d9362fb979f5fc92829431a590a130929f
 https://cems.fun/2026/04/27/krb5-two-unauthenticated-network-
 vulnerabilities.html
 https://www.youtube.com/watch?v=zpBrriAJxCQ
 }}}
-- 
Ticket URL: <https://wiki.linuxfromscratch.org/blfs/ticket/23215>
BLFS Trac <https://wiki.linuxfromscratch.org/blfs/>
Beyond Linux From Scratch

-- 
http://lists.linuxfromscratch.org/sympa/info/blfs-book
Unsubscribe: See the above information page