The vulnerabilities CVE-2024-37370 and CVE-2024-37371 affect the GSS message token handling component of krb5, the Kerberos network authentication system. These issues were identified and addressed in Red Hat Enterprise Linux 7.7 AUS through updated krb5 packages. Kerberos facilitates secure mutual authentication between clients and servers by using a trusted third party, the KDC, thereby preventing insecure password transmission. The Red Hat advisory RHSA-2024:5316 provides the official update and remediation details. No CVSS scores are provided in the advisory, but the issues are rated as moderate in severity by Red Hat Product Security.

The vulnerabilities impact the krb5 GSS message token handling, potentially affecting the security of Kerberos authentication processes. While the exact technical impact is not detailed in the advisory, the moderate severity rating suggests a security risk that could affect authentication integrity or confidentiality if exploited. There are no known exploits in the wild currently reported. The issues affect Red Hat Enterprise Linux Server AUS 7.7 and related krb5 packages.

Red Hat has released updated krb5 packages for Red Hat Enterprise Linux 7.7 AUS that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2024:5316 and the referenced article https://access.redhat.com/articles/11258 to remediate the issues. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.