This security advisory from Red Hat addresses two moderate-severity vulnerabilities in the krb5 package used in Red Hat Enterprise Linux 9. Both CVE-2024-37370 and CVE-2024-37371 involve issues in GSS (Generic Security Services) message token handling within the Kerberos authentication system. Kerberos is critical for secure network authentication by preventing unencrypted password transmission and enabling mutual authentication via a trusted key distribution center. The vulnerabilities could potentially affect the integrity or security of the authentication process. Red Hat has released updated krb5 packages to remediate these issues across multiple supported architectures and product variants. Detailed CVSS scores and impact specifics are available on the respective CVE pages. Users are advised to apply the provided updates promptly.

The vulnerabilities affect the GSS message token handling in the krb5 package, which is integral to the Kerberos authentication system. While the advisory rates the impact as moderate, no specific exploitation details or known active exploits have been reported. The issues could potentially undermine the security assurances provided by Kerberos authentication if left unpatched. The impact is limited to affected Red Hat Enterprise Linux 9 systems using krb5.

An official security update is available from Red Hat to address these vulnerabilities. Users should apply the krb5 package update as described in the Red Hat advisory RHSA-2024:6166 and the associated article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor. Systems running affected versions of Red Hat Enterprise Linux 9 should be updated promptly to remediate these issues.