Unbounded Recursion Vulnerability in krb5 Package: CVE-2020-28196
Summary
ALPINE-CVE-2020-28196: MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recurs... Affects krb5 versions < 1.17.2-r0. Fixed in 1.17.2-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The krb5 package, also known as MIT Kerberos, is a widely used implementation of the Kerberos network authentication protocol. It provides secure authentication for users and services in a networked environment. The package is essential for ensuring secure communication and identity verification in various applications. However, it has been identified to have a vulnerability that allows for unbounded recursion, which can lead to potential denial of service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2020-28196, arises from the handling of ASN.1-encoded Kerberos messages. Specifically, the support for BER indefinite lengths in the asn1_encode.c file lacks a recursion limit, allowing attackers to exploit this flaw. This can lead to unbounded recursion, which may cause the application to crash or become unresponsive, resulting in a denial of service. The vulnerability affects multiple versions of the krb5 package prior to the patched versions.
How To Fix
Minimum fixed version
1.17.2-r0
This is the first release that contains the fix.
sudo apk add --upgrade krb5Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched versions as soon as possible.
Conclusion
The krb5 package has a significant vulnerability (CVE-2020-28196) that allows for unbounded recursion, posing a risk of denial of service. It is essential to update to the patched versions to ensure the security and stability of applications using this package.
See every vulnerability recorded for krb5 →
FAQ
CVE-2020-28196 is a vulnerability in the krb5 package that allows for unbounded recursion via ASN.1-encoded Kerberos messages, potentially leading to denial of service.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
Affected versions include krb5 prior to 1.17.2 for Alpine v3.10 and v3.11, and prior to 1.18.3 for Alpine v3.12 through v3.22.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
While there are no specific workarounds, it is crucial to prioritize updating the package to mitigate the risk associated with this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for krb5.
