CVE-2025-3576 Details

A vulnerability exists in the MIT Kerberos implementation that allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed. This issue arises from weaknesses in the MD5 checksum design, which can be exploited to forge message integrity codes. If RC4 is preferred over stronger encryption types, an attacker could manipulate messages without detection, leading to unauthorized tampering. The vulnerability affects several versions of the krb5 package in Red Hat Enterprise Linux 8, as well as in Red Hat Ansible Automation Platform 2. It requires a Kerberos environment with PKINIT enabled, and exploitation depends on specific memory allocation failures or parser behaviors, making the attack complex.

Users can upgrade to the patched krb5 version 1.18.3-6+deb11u7, available through the Red Hat Update System. For Red Hat Enterprise Linux 8, the update is included in the RHSA-2025:8411 advisory.