This advisory addresses two moderate severity vulnerabilities in the krb5 package used by Red Hat Enterprise Linux 9.2 EUS. Both CVE-2024-37370 and CVE-2024-37371 relate to GSS message token handling within the Kerberos authentication system. The vulnerabilities could impact the secure authentication process facilitated by the Kerberos Key Distribution Center (KDC). Red Hat has released updated krb5 packages containing fixes for these issues. The advisory covers multiple architectures and product variants under Red Hat Enterprise Linux 9.2 Extended Update Support. No detailed CVSS scores are provided in the advisory, and no active exploitation has been reported.

The vulnerabilities affect the krb5 package's handling of GSS message tokens, potentially impacting the security of the Kerberos authentication process. Since Kerberos is critical for secure network authentication by preventing unencrypted password transmission, these flaws could undermine authentication integrity. However, the advisory rates the impact as moderate and there are no known exploits in the wild at this time. The exact technical impact details and CVSS scores are not provided in the advisory.

Red Hat has released updated krb5 packages that address these vulnerabilities. Users running affected versions of Red Hat Enterprise Linux 9.2 Extended Update Support should apply the security update as described in the Red Hat advisory RHSA-2024:5643 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended and effective mitigation. No additional or alternative mitigations are indicated by the vendor.