Alpine: multiple krb5 packages: security update to 1.13-r0 (deprecated)

high Tenable Cloud Security Plugin ID 401136

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- The krb5_ldap_get_password_policy_from_dn function in plugins/kdb/ldap/libkdb_ldap/ldap_pwd_policy.c in
MIT Kerberos 5 (aka krb5) before 1.13.1, when the KDC uses LDAP, allows remote authenticated users to
cause a denial of service (daemon crash) via a successful LDAP query with no results, as demonstrated by
using an incorrect object type for a password policy. (CVE-2014-5353)

- plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in MIT Kerberos 5 (aka krb5) 1.12.x and 1.13.x before
1.13.1, when the KDC uses LDAP, allows remote authenticated users to cause a denial of service (NULL
pointer dereference and daemon crash) by creating a database entry for a keyless principal, as
demonstrated by a kadmin "add_principal -nokey" or "purgekeys -all" command. (CVE-2014-5354)

Plugin Details

Severity: High

ID: 401136

Version: Revision 1.23

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Low

Base Score: 3.5

Temporal Score: 2.6

Vector: CVSS2#AV:N/AC:M/Au:S/C:N/I:N/A:P

CVSS Score Source: CVE-2014-5354

CVSS v3

Risk Factor: High

Base Score: 8.1

Temporal Score: 7.1

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 1/30/2015

Vulnerability Publication Date: 11/20/2014

Reference Information

CVE: CVE-2014-5353, CVE-2014-5354

BID: 71679, 71680

Detections

Analytics