CVE-2023-36054

Published: Aug 7, 2023Modified: Jun 17, 2026

6.5

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Exploitability: 2.8 / Impact: 3.6

Source: NVD

Description

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

Affected (9)

Products: Mit: Kerberos 5 · Debian: Debian Linux · Netapp: Active Iq Unified Manager, Clustered Data Ontap, Hci, Management Services For Element Software, Ontap Tools

1 product

1 product

5 products

Active Iq Unified Manager

Clustered Data Ontap

Hci

Management Services For Element Software

Ontap Tools

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mit Kerberos 5	Before 1.20.2
Mit Kerberos 5	Version 1.21
Mit Kerberos 5	Version 1.21 beta1

Configuration B

1 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0

Configuration C

5 vulnerable

Vulnerable Software	Affected Versions
Netapp Active Iq Unified Manager	All versions
Netapp Clustered Data Ontap	Version 9.0
Netapp Hci	All versions
Netapp Management Services For Element Software	All versions
Netapp Ontap Tools	All versions