High · published November 6, 2020
MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
| Product | Versions | Fixed in |
|---|---|---|
| mit/kerberos_5 | < 1.17.2 | 1.17.2 |
| mit/kerberos_5 | ≥ 1.18.0, < 1.18.3 | 1.18.3 |
| fedoraproject/fedora | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/cloud_backup | all versions | — |
| netapp/oncommand_insight | all versions | — |
| netapp/oncommand_workflow_automation | all versions | — |
| netapp/snapcenter | all versions | — |
| oracle/communications_cloud_native_core_policy | all versions | — |
| oracle/communications_offline_mediation_controller | all versions | — |
| oracle/communications_pricing_design_center | all versions | — |
| oracle/mysql_server | ≤ 8.0.23 | — |