← Back

CVE-2020-28196

nvd nist
Published: Nov 6, 2020Modified: Oct 14, 2026

JSON object

Loading...
7.5
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Exploitability: 3.9 / Impact: 3.6
Source: NVD

Description

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Affected (13)

Show all products
Mit: Kerberos 5 · Fedoraproject: Fedora · Netapp: Active Iq Unified Manager, Cloud Backup, Oncommand Insight, Oncommand Workflow Automation, Snapcenter · Oracle: Communications Cloud Native Core Policy, Communications Offline Mediation Controller, Communications Pricing Design Center, Mysql Server
Mit
1 product
Kerberos 5
Fedoraproject
1 product
Fedora
Netapp
5 products
Active Iq Unified Manager
Cloud Backup
Oncommand Insight
Oncommand Workflow Automation
Snapcenter
Oracle
4 products
Communications Cloud Native Core Policy
Communications Offline Mediation Controller
Communications Pricing Design Center
Mysql Server
Configuration A
2 vulnerable
Vulnerable SoftwareAffected Versions
Mit
Kerberos 5
version < 1.17.2
Kerberos 5
1.18.0 ≤ version < 1.18.3
Configuration B
1 vulnerable
Vulnerable SoftwareAffected Versions
Fedora
Version 31
Configuration C
6 vulnerable
Vulnerable SoftwareAffected Versions
Netapp
Active Iq Unified Manager
All versions
Active Iq Unified Manager
All versions
Cloud Backup
All versions
Oncommand Insight
All versions
Oncommand Workflow Automation
All versions
Snapcenter
All versions
Configuration D
4 vulnerable
Vulnerable SoftwareAffected Versions
Communications Cloud Native Core Policy
Version 1.14.0
Communications Offline Mediation Controller
Version 12.0.0.3.0
Communications Pricing Design Center
Version 12.0.0.3.0
Mysql Server
version ≤ 8.0.23

Related CWEs

CWE-674
Uncontrolled Recursion
The product does not properly control the amount of recursion that takes place, consuming excessive resources, such as allocated memory or the program stack.

References (29)

Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Mailing ListThird Party Advisory
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
Third Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: cve@mitre.org
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
PatchThird Party Advisory
Source: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e

Timeline

No history available yet.