CVE-2024-37371: Critical severity MIT Kerberos 5 vulnerability
In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can cause invalid memory reads during GSS message token handling by sending message tokens with invalid length fields.
Other sources
MIT Kerberos 5 (aka krb5) is vulnerable to a denial of service, caused by an invalid memory reads during GSS message token handling. By sending specially crafted message tokens, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
— IBM
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37371?
CVE-2024-37371 has been classified with a high severity due to its potential for causing invalid memory reads.
How do I fix CVE-2024-37371?
To fix CVE-2024-37371, upgrade to MIT Kerberos 5 version 1.21.3 or later.
Which versions of MIT Kerberos 5 are affected by CVE-2024-37371?
Versions of MIT Kerberos 5 earlier than 1.21.3 are affected by CVE-2024-37371.
What products are impacted by CVE-2024-37371?
CVE-2024-37371 impacts IBM QRadar SIEM and IBM QRadar Incident Forensics up to version 7.5.0 UP9 IF03.
What attack vector is associated with CVE-2024-37371?
CVE-2024-37371 can be exploited through malformed GSS message tokens with invalid length fields.