CVE-2022-42898

CWE-190 — Integer Overflow19 documents9 sources
Severity
8.8HIGH
EPSS
8.9%
top 7.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Heimdal Project HeimdalMIT Kerberos 5Samba Samba
Timeline
PublishedDec 25
Latest updateJun 30

Description

PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages8 packages

▶NVDmit/kerberos_51.8 — 1.19.4+1
▶Debiankrb5< 1.18.3-6+deb11u3+3
▶Ubuntukrb5< 1.16-2ubuntu0.3+4
▶Debianheimdal< 7.7.0+dfsg-2+deb11u2+3

Patches

Patch: bugzilla.samba.org ↗Patch: github.com ↗Patch: bugzilla.samba.org ↗

🔴Vulnerability Details

6
OSV
samba regression↗2025-06-30
▶
OSV
samba vulnerabilities↗2025-06-19
▶
OSV
krb5 vulnerabilities↗2023-01-25
▶
OSV
heimdal vulnerabilities↗2023-01-12
▶
OSV
CVE-2022-42898: PAC parsing in MIT Kerberos 5 (aka krb5) before 1↗2022-12-25
▶

📋Vendor Advisories

12
Ubuntu
Samba vulnerabilities↗2025-06-19
▶
Oracle
Oracle Oracle MySQL Risk Matrix: Cluster: General (Kerberos) — CVE-2022-42898↗2023-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Kerberos) — CVE-2022-42898↗2023-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Installation and Configuration (Kerberos) — CVE-2022-42898↗2023-04-15
▶
Ubuntu
Samba vulnerabilities↗2023-03-08
▶