What’s Vulnerable › Vulnerabilities

CVE-2024-37370

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-28 · updated 2026-06-17
• Weakness: CWE-345

Description

In MIT Kerberos 5 (aka krb5) before 1.21.3, an attacker can modify the plaintext Extra Count field of a confidential GSS krb5 wrap token, causing the unwrapped token to appear truncated to the application.

Affected products

• MIT Kerberos 5: before 1.21.3 — fixed in 1.21.3

How to fix

Upgrade to a fixed version: MIT Kerberos 5 1.21.3. Check the vendor advisory for mitigations.

References

• https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
• https://web.mit.edu/kerberos/www/advisories/
• https://github.com/krb5/krb5/commit/55fbf435edbe2e92dd8101669b1ce7144bc96fef
• https://security.netapp.com/advisory/ntap-20241108-0007/
• https://web.mit.edu/kerberos/www/advisories/
• https://cert-portal.siemens.com/productcert/html/ssa-082556.html

Get alerted when CVE-2024-37370 or the next vulnerability affects your stack