Source: krb5 Version: 1.16-2 Severity: important Tags: security upstream Hi,
the following vulnerability was published for krb5, filling a bug to track the issue once more details are available. CVE-2018-5709[0]: | An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. | There is a variable "dbentry->n_key_data" in kadmin/dbutil/dump.c that | can store 16-bit data but unknowingly the developer has assigned a "u4" | variable to it, which is for 32-bit data. An attacker can use this | vulnerability to affect other artifacts of the database as we know that | a Kerberos database dump file contains trusted data. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2018-5709 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5709 Please adjust the affected versions in the BTS as needed, once known. Regards, Salvatore
