Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2023-36054 Details

Description

lib/kadm5/kadm_rpc_xdr.c in MIT Kerberos 5 (aka krb5) before 1.20.2 and 1.21.x before 1.21.1 frees an uninitialized pointer. A remote authenticated user can trigger a kadmind crash. This occurs because _xdr_kadm5_principal_ent_rec does not validate the relationship between n_key_data and the key_data array count.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:6.5 MEDIUMVector:CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://github.com/krb5/krb5/commit/ef08b09c9459551aabbe7924fb176f1583053cdd CVEPatch
https://github.com/krb5/krb5/compare/krb5-1.20.1-final...krb5-1.20.2-final CVEPatch
https://github.com/krb5/krb5/compare/krb5-1.21-final...krb5-1.21.1-final CVEPatch
https://lists.debian.org/debian-lts-announce/2023/10/msg00031.html CVEMailing ListThird Party Advisory
https://security.netapp.com/advisory/ntap-20230908-0004/ CVEThird Party Advisory

see all 12 references

Weakness Enumeration

CWE-IDCWE NameSource
CWE-824Access of Uninitialized Pointer[email protected]

Affected Products

ProductVersions

Change History

8 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2023-36054
NVD Published Date:
Aug 7, 2023
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2023-36054 Details - Not Deferred