Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1242604

Bug#1103525: krb5: CVE-2025-3576

Show all headers | View raw

Source: krb5
X-Debbugs-CC: team@security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerability was published for krb5.

CVE-2025-3576[0]:
| A vulnerability in the MIT Kerberos implementation allows GSSAPI-
| protected messages using RC4-HMAC-MD5 to be spoofed due to
| weaknesses in the MD5 checksum design. If RC4 is preferred over
| stronger encryption types, an attacker could exploit MD5 collisions
| to forge message integrity codes. This may lead to unauthorized
| message tampering.

So far the only reference here is from Red Hat Bugzilla:
https://bugzilla.redhat.com/show_bug.cgi?id=2359465


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2025-3576
    https://www.cve.org/CVERecord?id=CVE-2025-3576

Please adjust the affected versions in the BTS as needed.

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1103525: krb5: CVE-2025-3576 Moritz Mühlenhoff <jmm@inutil.org> - 2025-04-18 18:10 +0200
  Bug#1103525: more info about CVE-2025-3576 "Benjamin Kaduk" <kaduk@mit.edu> - 2025-04-18 22:00 +0200

csiph-web