Critical Security Update for python3-kdcproxy: Addressing Unauthenticated SSRF and Remote DoS Vulnerabilities
Summary
ALSA-2025:21142: Important: python-kdcproxy security update. Affects python3-kdcproxy versions < 1.0.0-19.el10_1. Fixed in 1.0.0-19.el10_1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
python3-kdcproxy is a Python-based implementation of a KDC proxy, which facilitates communication between clients and Kerberos Key Distribution Centers (KDCs). It is designed to enhance security and performance in environments utilizing Kerberos authentication. However, recent vulnerabilities have been identified that could compromise the integrity and availability of systems using this package.
Vulnerability Detail
The vulnerabilities in python3-kdcproxy stem from two critical issues: an unauthenticated Server-Side Request Forgery (SSRF) vulnerability via Realm-controlled DNS SRV records (CVE-2025-59088) and a remote Denial of Service (DoS) vulnerability due to unbounded TCP upstream buffering (CVE-2025-59089). The SSRF vulnerability allows attackers to send crafted requests that can access internal services, potentially leading to data exposure or further exploitation. The DoS vulnerability can be exploited to exhaust server resources, rendering the service unavailable to legitimate users.
How To Fix
Minimum fixed version
1.0.0-19.el10_1
This is the first release that contains the fix.
sudo dnf update python3-kdcproxyTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing network-level controls to restrict access to internal services and monitor traffic for unusual patterns. Additionally, you can disable the use of DNS SRV records in your configuration until the package is updated.
Conclusion
The identified vulnerabilities in python3-kdcproxy pose significant security risks that require immediate attention. Updating to the latest patched version is crucial to protect against potential exploitation. Users are encouraged to monitor their systems and apply the necessary updates promptly.
See every vulnerability recorded for python3-kdcproxy →
FAQ
CVE-2025-59088 refers to an unauthenticated SSRF vulnerability in python3-kdcproxy that allows attackers to access internal services by manipulating DNS SRV records.
CVE-2025-59089 is a remote DoS vulnerability in python3-kdcproxy that can lead to service unavailability due to unbounded TCP upstream buffering.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without needing to sign up.
The SSRF vulnerability can lead to unauthorized access to internal services, while the DoS vulnerability can disrupt service availability, affecting users and operations.
Yes, implementing network-level controls and monitoring traffic can help mitigate risks until the package is updated.
Related vulnerabilities
Recent vulnerabilities recorded for python3-kdcproxy.
