CVE-2019-12098 — Project Heimdal vulnerability
12 documents8 sources
Severity
7.4HIGHNVD
EPSS
2.8%
top 13.80%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMay 15
Latest updateApr 16
Description
In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NExploitability: 2.2 | Impact: 5.2
Affected Packages4 packages
Also affects: Debian Linux 9.0, Fedora 30, 31
Patches
🔴Vulnerability Details
5📋Vendor Advisories
2💬Community
4Bugzilla▶
CVE-2019-12098 heimdall: heimdal: man-in-the-middle attack in function krb5_init_creds_step in lib/krb5/init_creds_pw.c [fedora-all]↗2019-05-16
Bugzilla▶
CVE-2019-12098 heimdal: man-in-the-middle attack in function krb5_init_creds_step in lib/krb5/init_creds_pw.c↗2019-05-16
Bugzilla▶
CVE-2019-12098 heimdal: man-in-the-middle attack in function krb5_init_creds_step in lib/krb5/init_creds_pw.c [fedora-all]↗2019-05-16
Bugzilla▶
CVE-2019-12098 heimdal: man-in-the-middle attack in function krb5_init_creds_step in lib/krb5/init_creds_pw.c [epel-all]↗2019-05-16