This advisory addresses two moderate severity vulnerabilities in the krb5 package used by Red Hat Enterprise Linux 8.6 variants. Both CVE-2024-37370 and CVE-2024-37371 relate to GSS (Generic Security Services) message token handling within the Kerberos authentication system. Kerberos facilitates secure mutual authentication between clients and servers via a trusted Key Distribution Center (KDC). The vulnerabilities could potentially impact the security of authentication tokens. Red Hat has released updated krb5 packages that fix these issues. The advisory references the official Red Hat errata RHSA-2024:5625 and provides package details for remediation. No exploits are currently known in the wild, and the severity is rated moderate by Red Hat.

The vulnerabilities affect the handling of GSS message tokens in krb5, which could undermine the security of Kerberos authentication processes. While the exact impact details and CVSS scores are not provided in the advisory, Red Hat rates the security impact as moderate. There are no known active exploits targeting these vulnerabilities at this time. The issues could potentially allow attackers to interfere with or bypass authentication mechanisms relying on Kerberos if left unpatched.

Red Hat has released updated krb5 packages that address these vulnerabilities. Users should apply the security updates as described in the Red Hat advisory RHSA-2024:5625 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional or alternative mitigations are indicated by the vendor. Systems running affected Red Hat Enterprise Linux 8.6 variants should be updated promptly to ensure protection.