This advisory addresses two moderate severity vulnerabilities in the krb5 package used by Red Hat Enterprise Linux 8.4 and related variants. Both CVE-2024-37370 and CVE-2024-37371 concern GSS (Generic Security Services) message token handling within the Kerberos authentication system. Kerberos is a trusted third-party authentication protocol that prevents sending unencrypted passwords over the network. The update fixes these vulnerabilities by updating krb5 packages to version 1.18.2-9.el8_4.1 or later. The advisory does not provide CVSS scores but rates the impact as moderate. No exploitation in the wild has been reported, and the vendor provides official patches.

The vulnerabilities affect the GSS message token handling in krb5, potentially impacting the security of Kerberos authentication processes. Since Kerberos is critical for secure network authentication, flaws in token handling could undermine authentication integrity or confidentiality. However, the advisory rates the impact as moderate and no active exploitation has been observed. The exact technical impact details are not provided in the advisory, and no CVSS scores are available.

Red Hat has released updated krb5 packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 8.4 variants should apply the security update as described in Red Hat advisory RHSA-2024:4734. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is an official fix, applying the update fully mitigates the vulnerabilities. No additional mitigation steps are indicated by the vendor.