CVE-2019-12098

Name of the Vulnerable Software and Affected Versions Heimdal versions prior to 7.6.0

Description The issue is related to the implementation of the Kerberos protocol in Heimdal, specifically with errors in cryptographic key management. This allows a remote attacker to perform a man-in-the-middle attack due to the failure to verify anonymous PKINIT PA-PKINIT-KX key exchange. The problem is located in the krb5 init creds step function in lib/krb5/init creds pw.c.

Recommendations For Heimdal versions prior to 7.6.0, update to version 7.6.0 or later to resolve the issue. As a temporary workaround, consider restricting the use of the krb5 init creds step function until a patch is available.