This advisory covers two moderate security vulnerabilities in the krb5 package (CVE-2024-37370 and CVE-2024-37371) affecting Red Hat Enterprise Linux 7 Extended Lifecycle Support. Both issues involve GSS message token handling. Red Hat has released updated krb5 packages (version 1.15.1-55.el7_9.2) that address these vulnerabilities. The advisory references the official Red Hat errata RHSA-2024:5076 and provides package details for multiple architectures. No CVSS scores are provided in the advisory, and no known active exploitation has been reported.

The vulnerabilities impact the krb5 package used for Kerberos authentication in Red Hat Enterprise Linux 7 ELS. The security impact is rated as moderate by Red Hat Product Security. Exploitation could potentially affect the integrity or processing of GSS message tokens, but no active exploits are known. The update mitigates these issues by correcting the handling of GSS tokens.

Red Hat has released updated krb5 packages to fix these vulnerabilities. Users running Red Hat Enterprise Linux 7 Extended Lifecycle Support should apply the security update as described in the Red Hat advisory RHSA-2024:5076 and the update instructions at https://access.redhat.com/articles/11258. Since an official fix is available, applying the update is the recommended remediation. No additional mitigation steps are indicated by the vendor.