Red Hat Product Security issued an advisory (RHSA-2024:5312) for krb5 in Red Hat Enterprise Linux 8 addressing two vulnerabilities identified as CVE-2024-37370 and CVE-2024-37371. Both vulnerabilities concern GSS (Generic Security Services) message token handling in the Kerberos authentication system. The advisory rates the security impact as moderate and provides updated krb5 packages to remediate these issues. The advisory references the CVE pages for detailed impact and scoring information, though no CVSS scores are currently provided. The update applies to multiple architectures of Red Hat Enterprise Linux 8 and its Extended Life Cycle versions.

The vulnerabilities affect the GSS message token handling in krb5, potentially impacting the security of the Kerberos authentication process. While specific exploitation details and impact scenarios are not provided, the moderate severity rating indicates a security risk that could affect authentication integrity or confidentiality if exploited. No known exploits in the wild have been reported at this time.

Red Hat has released updated krb5 packages for Red Hat Enterprise Linux 8 and its Extended Life Cycle versions that address these vulnerabilities. Users should apply the official security update as described in Red Hat advisory RHSA-2024:5312 and the referenced update article (https://access.redhat.com/articles/11258). Patch status is confirmed as fixed in these updated packages. No additional mitigation steps are indicated by the vendor.