CVE-2017-15088
Reported by redhat · Published November 23, 2017
plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.
Affected products
| Vendor | Product | Versions |
|---|---|---|
| n/a | krb5 1.5 | krb5 1.5 |
| n/a | krb5 1.5 | 1.5 |
| alpine | krb5 | 0 |
| arch | krb5 | 1.15.2-1 |
Timeline
- Nov 8, 2017 CVE Published
- Apr 14, 2021 EPSS Score (30 in total, the first dated here)
- May 13, 2022 CVE Updated
- Apr 7, 2026 Security Advisory
- Oct 3, 2026 Coalition ESS Score
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2017-15088
vulnetix vdb fixes CVE-2017-15088Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2017-15088/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- x_refsource_CONFIRM
- 101594 vdb-entryx_refsource_BID