CVE-2024-26461
Publication date 29 February 2024
Last updated 24 July 2024
Ubuntu priority
Kerberos 5 (aka krb5) 1.21.2 contains a memory leak vulnerability in /krb5/src/lib/gssapi/krb5/k5sealv3.c.
Read the notes from the security team
Why is this CVE low priority?
memory leak only unlikely to be triggered
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| krb5 | 24.04 LTS noble |
Vulnerable
|
| 22.04 LTS jammy |
Vulnerable
|
|
| 20.04 LTS focal |
Vulnerable
|
|
| 18.04 LTS bionic |
Vulnerable
|
|
| 16.04 LTS xenial |
Vulnerable
|
|
| 14.04 LTS trusty |
Vulnerable
|
Notes
mdeslaur
per upstream: "The k5sealv3.c leak affects an encoding function, and happens on a bounds check which likely cannot be triggered with any choice of memory-valid API inputs. (The bounds check was itself introduced to quash a different static analysis defect.)"