| Package | Affected versions | Patched versions |
|---|---|---|
| heimdal | < 7.6.0 | 7.6.0 |
| backports sle | = 15.0 |
In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free