Threats tagged 'ghsa-r2wv-55xh-q3w6'

A vulnerability in MIT Kerberos 5 (krb5) 1.11 and later allows remote attackers to cause a denial of service by sending specially crafted unauthenticated AS-REQ or TGS-REQ messages with a large number of elements in a SEQUENCE OF field over TCP. This triggers excessive CPU consumption in the Kerberos Key Distribution Center (KDC), degrading its availability. The issue arises because the decode_sequence_of() function grows the decoded element array one entry at a time, leading to inefficient processing. The vulnerability does not allow unauthorized data disclosure or remote code execution. Mitigation involves restricting TCP port 88 access to trusted networks to prevent exploitation from untrusted sources.