Red Hat Product Security has issued an advisory (RHSA-2024:5312) for two vulnerabilities in krb5 related to GSS message token handling (CVE-2024-37370 and CVE-2024-37371). These vulnerabilities affect Red Hat Enterprise Linux 8 and its variants. Kerberos is a network authentication protocol that uses a trusted third party (KDC) to authenticate clients and servers. The advisory rates the security impact as moderate and provides updated krb5 packages to fix these issues. No CVSS scores are provided in the advisory, but the vulnerabilities are considered moderate in severity.

The vulnerabilities affect the krb5 package used in Red Hat Enterprise Linux 8, potentially impacting the security of the Kerberos authentication process. Since Kerberos is critical for secure authentication without sending passwords in cleartext, flaws in GSS message token handling could undermine authentication integrity or confidentiality. However, no known exploitation in the wild has been reported, and the overall impact is rated moderate by Red Hat.

Red Hat has released updated krb5 packages for Red Hat Enterprise Linux 8 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2024:5312 and the referenced article https://access.redhat.com/articles/11258. Applying the official patch is the recommended remediation. There is no indication that additional mitigations or workarounds are necessary beyond installing the update.