CVE-2020-28196

Published: Nov 6, 2020Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Affected (13)

Products: Mit: Kerberos 5 · Fedoraproject: Fedora · Netapp: Active Iq Unified Manager, Cloud Backup, Oncommand Insight, Oncommand Workflow Automation, Snapcenter · +1 more

Show all products

Mit: Kerberos 5 · Fedoraproject: Fedora · Netapp: Active Iq Unified Manager, Cloud Backup, Oncommand Insight, Oncommand Workflow Automation, Snapcenter · Oracle: Communications Cloud Native Core Policy, Communications Offline Mediation Controller, Communications Pricing Design Center, Mysql Server

1 product

1 product

5 products

Active Iq Unified Manager

Oncommand Insight

Oncommand Workflow Automation

4 products

Communications Cloud Native Core Policy

Communications Offline Mediation Controller

Communications Pricing Design Center

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos 5	Before 1.17.2
Mit Kerberos 5	From 1.18.0 to 1.18.3

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 31

Configuration C

6 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Active Iq Unified Manager	All versions
Netapp Cloud Backup	All versions
Netapp Oncommand Insight	All versions
Netapp Oncommand Workflow Automation	All versions
Netapp Snapcenter	All versions

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Oracle Communications Cloud Native Core Policy	Version 1.14.0
Oracle Communications Offline Mediation Controller	Version 12.0.0.3.0
Oracle Communications Pricing Design Center	Version 12.0.0.3.0
Oracle Mysql Server	Up to 8.0.23

Related CWEs

Uncontrolled Recursion

The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (28)

https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd

Source: cve@mitre.org

PatchThird Party Advisory

https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E

Source: cve@mitre.org

https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

Source: cve@mitre.org

https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/

Source: cve@mitre.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/

Source: cve@mitre.org

https://security.gentoo.org/glsa/202011-17

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20201202-0001/

Source: cve@mitre.org

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210513-0002/

Source: cve@mitre.org

Third Party Advisory

https://www.debian.org/security/2020/dsa-4795

Source: cve@mitre.org

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: cve@mitre.org

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: cve@mitre.org

PatchThird Party Advisory

https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/

Source: af854a3a-2127-422b-91ae-364da2661108

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/

Source: af854a3a-2127-422b-91ae-364da2661108

https://security.gentoo.org/glsa/202011-17

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20201202-0001/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://security.netapp.com/advisory/ntap-20210513-0002/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.debian.org/security/2020/dsa-4795

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://www.oracle.com//security-alerts/cpujul2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuApr2021.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.oracle.com/security-alerts/cpuapr2022.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

Timeline

No history available yet.