Critical Security Flaws in python3-kdcproxy: Unauthenticated SSRF and Remote DoS Vulnerabilities
Summary
ALSA-2025:21139: Important: python-kdcproxy security update. Affects python3-kdcproxy versions < 1.0.0-9.el9_7. Fixed in 1.0.0-9.el9_7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python3-kdcproxy is a Python-based implementation of a KDC proxy that facilitates authentication requests in a Kerberos environment. It is designed to enhance security and manageability in distributed systems by allowing clients to communicate with KDCs without exposing them directly. The package supports dynamic typing and high-level data types, making it versatile for various applications. However, recent vulnerabilities have been identified that could compromise its security.
Vulnerability Detail
The vulnerabilities in python3-kdcproxy include an unauthenticated Server-Side Request Forgery (SSRF) via Realm-controlled DNS SRV (CVE-2025-59088) and a remote Denial of Service (DoS) due to unbounded TCP upstream buffering (CVE-2025-59089). The SSRF vulnerability allows attackers to send crafted requests that can manipulate the server into making unintended requests to internal resources, potentially leading to data exposure. The DoS vulnerability can be exploited to exhaust server resources, causing service interruptions and unavailability.
How To Fix
Minimum fixed version
1.0.0-9.el9_7
This is the first release that contains the fix.
sudo dnf update python3-kdcproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can restrict access to the KDC proxy service or implement network-level controls to limit exposure to potential SSRF attacks. Additionally, monitoring and rate-limiting incoming requests may help mitigate the impact of the DoS vulnerability until a patch is applied.
Conclusion
The identified vulnerabilities in python3-kdcproxy pose significant security risks, including potential data exposure and service disruptions. It is crucial to update to the latest patched version to safeguard against these threats. Implementing workarounds can provide temporary relief, but a permanent fix through updates is recommended.
See every vulnerability recorded for python3-kdcproxy →
FAQ
SSRF (Server-Side Request Forgery) is a security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially leading to unauthorized access or data exposure.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Check your application against the vulnerability using the Vulert playground at Vulert Scanner.
A remote DoS attack can exhaust server resources, leading to service unavailability, degraded performance, and potential loss of revenue or user trust.
Yes, the SSRF vulnerability could potentially expose sensitive internal data if exploited, while the DoS vulnerability may disrupt service but does not directly cause data loss.
If immediate updates are not possible, implement network restrictions, monitor traffic, and apply rate limiting to mitigate the risks until the package can be updated.
Related vulnerabilities
Recent vulnerabilities recorded for python3-kdcproxy.
