Alpine: multiple krb5 packages: security update to 1.15.3-r0

critical Tenable Cloud Security Plugin ID 423995

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles
Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial
of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related
to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use
cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin
code that is specific to Red Hat. (CVE-2017-15088)

- An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. There is a variable
"dbentry->n_key_data" in kadmin/dbutil/dump.c that can store 16-bit data but unknowingly the developer has
assigned a "u4" variable to it, which is for 32-bit data. An attacker can use this vulnerability to affect
other artifacts of the database as we know that a Kerberos database dump file contains trusted data.
(CVE-2018-5709)

- An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function "strlen" is
getting a "NULL" string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key
Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL
pointer dereference) via a modified kadmin client. (CVE-2018-5710)

Plugin Details

Severity: Critical

ID: 423995

Version: Revision 1.8

Type: Local

Family: Alpine Linux Local Security Checks

Published: 4/4/2025

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 4.9

Percentile: 57.15

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2017-15088

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Vulnerability Publication Date: 10/25/2017

Reference Information

CVE: CVE-2017-15088, CVE-2018-5709, CVE-2018-5710

BID: 101594

Detections

Analytics