Red Hat Product Security released an advisory (RHSA-2024:6166) for krb5 in Red Hat Enterprise Linux 9 addressing two vulnerabilities identified as CVE-2024-37370 and CVE-2024-37371. Both issues involve GSS message token handling within the krb5 package, which is part of the Kerberos network authentication system. The advisory rates the security impact as moderate. The update fixes these vulnerabilities by patching the krb5 packages across multiple supported architectures and variants of RHEL 9. No detailed CVSS scores are provided in the advisory, and no exploits are currently known to be active in the wild. The vendor provides official patches and guidance for applying the update.

The vulnerabilities affect the krb5 component responsible for GSS message token handling in Kerberos authentication. Exploitation could potentially impact the authentication process, but the advisory rates the impact as moderate. No known active exploits have been reported. The issues could undermine the security guarantees of Kerberos if left unpatched.

An official security update from Red Hat is available for krb5 in Red Hat Enterprise Linux 9. Users should apply the update as provided by Red Hat to remediate the vulnerabilities. For detailed instructions, refer to Red Hat's official update guidance at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.