Red Hat Product Security issued an advisory (RHSA-2024:4743) addressing two moderate severity vulnerabilities in krb5, specifically related to GSS message token handling (CVE-2024-37370 and CVE-2024-37371). Kerberos is a network authentication protocol that uses a trusted third party (KDC) to authenticate clients and servers. The vulnerabilities affect Red Hat Enterprise Linux 8.8 Extended Update Support and related packages. Red Hat has released updated krb5 packages to fix these issues. The advisory includes detailed package versions and SHA-256 checksums for verification. No CVSS score is provided in the advisory, but the severity is classified as moderate. There are no known exploits in the wild. Users are directed to Red Hat's official update article for applying the fix.

The vulnerabilities impact the krb5 component's handling of GSS message tokens, which could potentially affect the security of the Kerberos authentication process. The advisory classifies the security impact as moderate. No known exploitation in the wild has been reported. The issues could affect authentication reliability or security in environments using the affected Red Hat Enterprise Linux 8.8 Extended Update Support versions.

An official security update from Red Hat is available and should be applied to affected systems running Red Hat Enterprise Linux 8.8 Extended Update Support. The advisory provides updated krb5 packages and instructions for applying the update. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to remediate these vulnerabilities. No additional mitigation steps are indicated or required beyond applying the official patch.