cbcvebase.
CVE-2019-12098
published 2019-05-15

CVE-2019-12098: In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in…

PriorityP338high7.4CVSS 3.1
AVNACHPRNUINSUCHIHAN
EPSS
1.98%
78.3th percentile
In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

Affected

17 ranges
VendorProductVersion rangeFixed in
debiandebian_linux——
debianheimdal< heimdal 7.5.0+dfsg-3 (bookworm)heimdal 7.5.0+dfsg-3 (bookworm)
fedoraprojectfedora——
fedoraprojectfedora——
heimdal_projectheimdal< 7.6.07.6.0
heimdal_projectheimdal>= 0 < 7.5.0+dfsg-37.5.0+dfsg-3
heimdal_projectheimdal>= 0 < 7.5.0+dfsg-37.5.0+dfsg-3
heimdal_projectheimdal>= 0 < 7.5.0+dfsg-37.5.0+dfsg-3
heimdal_projectheimdal>= 0 < 7.5.0+dfsg-37.5.0+dfsg-3
heimdal_projectheimdal>= 0 < 7.5.0+dfsg-1ubuntu0.17.5.0+dfsg-1ubuntu0.1
heimdal_projectheimdal>= 0 < 7.7.0+dfsg-1ubuntu1.17.7.0+dfsg-1ubuntu1.1
heimdal_projectheimdal>= 0 < 1.6~git20131207+dfsg-1ubuntu1.2+esm11.6~git20131207+dfsg-1ubuntu1.2+esm1
heimdal_projectheimdal>= 0 < 1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm11.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1
opensusebackports_sle——
opensuseleap——
opensuseleap——
opensuseleap——

CVSS provenance

nvdv3.17.4HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian7.4HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.