GitHub Advisoryadvisory · PyPI
GHSA-mffc-9gx5-99g3 python-kerberos vulnerable to KDC spoofing attacks
CRITICAL
Official page ↗
- Aliases
- CVE-2015-3206
- Ecosystem
- PyPI
- Packages
- kerberos, pykerberos
- Severity
- Critical
- CVSS vector
- CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-287
- Reviewed
- 2024-02-23
Affected packages
• PyPI kerberos: <= 1.2.5 (no fix yet)
• PyPI pykerberos: < 1.1.6 → fixed in 1.1.6
Description
The `checkPassword` function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack.
Related
Alias · CVE (1)
- CVE-2015-3206 The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers… vulnerability
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2015-3206 advisory
- https://github.com/apple/ccs-pykerberos/issues/31 web
- https://github.com/apple/ccs-pykerberos/commit/9cb61c93f9b24dd18a0a315f3df5445529c5c333 web
- https://bugzilla.redhat.com/show_bug.cgi?id=1223802 web
- https://github.com/apple/ccs-pykerberos package
- https://github.com/pypa/advisory-database/tree/main/vulns/kerberos/PYSEC-2017-49.yaml web
- https://github.com/pypa/advisory-database/tree/main/vulns/pykerberos/PYSEC-2017-66.yaml web
- https://pypi.python.org/pypi/kerberos web
- https://web.archive.org/web/20150910143429/https://trac.calendarserver.org/ticket/833 web
- https://web.archive.org/web/20200228090829/http://www.securityfocus.com/bid/74760 web
- http://www.openwall.com/lists/oss-security/2015/05/21/3 web