This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2019-12098 →

DEBIAN-CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issu...

Original description

The description as published by the source.

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 heimdal

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-3"}]}]

Debian:13 heimdal

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-3"}]}]

Debian:14 heimdal

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-3"}]}]

References

advisory security-tracker.debian.org