CVE-2024-37370

Name of the Vulnerable Software and Affected Versions MIT Kerberos 5 versions prior to 1.21.3

Description The issue is related to the modification of the plaintext Extra Count field of a confidential GSS krb5 wrap token. This can cause the unwrapped token to appear truncated to the application, potentially allowing a remote attacker to gain unauthorized access to the GSS krb5 token.

Recommendations For versions prior to 1.21.3, update to version 1.21.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the GSS krb5 wrap token to minimize the risk of exploitation.