Search for vulnerabilities
Vulnerability details: VCID-11c1-meqb-aaaf
Vulnerability ID VCID-11c1-meqb-aaaf
Aliases CVE-2021-36222
Summary ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. This occurs because a return value is not properly managed in a certain situation.
Status Published
Exploitability 0.5
Weighted Severity 6.8
Risk 3.4
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-476 NULL Pointer Dereference
System Score Found at
rhas Moderate https://access.redhat.com/errata/RHSA-2021:3576
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-36222.json
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01199 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01735 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01735 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01735 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.01735 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.04704 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.04704 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05146 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05169 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05169 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05169 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05169 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05776 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05776 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05776 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05776 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05776 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05776 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.05776 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.08094 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.08094 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
epss 0.16009 https://api.first.org/data/v1/epss?cve=CVE-2021-36222
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=1983720
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2021-36222
cvssv3 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-36222
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2021-36222
archlinux Low https://security.archlinux.org/AVG-2173
cvssv3.1 8.2 https://www.oracle.com/security-alerts/cpuoct2021.html
generic_textual HIGH https://www.oracle.com/security-alerts/cpuoct2021.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-36222.json
https://api.first.org/data/v1/epss?cve=CVE-2021-36222
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36222
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/krb5/krb5/commit/fc98f520caefff2e5ee9a0026fdf5109944b3562
https://github.com/krb5/krb5/releases
https://security.netapp.com/advisory/ntap-20211022-0003/
https://security.netapp.com/advisory/ntap-20211104-0007/
https://web.mit.edu/kerberos/advisories/
https://www.debian.org/security/2021/dsa-4944
https://www.oracle.com/security-alerts/cpuoct2021.html
1983720 https://bugzilla.redhat.com/show_bug.cgi?id=1983720
991365 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=991365
AVG-2173 https://security.archlinux.org/AVG-2173
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:oncommand_workflow_automation:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:oracle:mysql_server:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2021-36222 https://nvd.nist.gov/vuln/detail/CVE-2021-36222
GLSA-202405-11 https://security.gentoo.org/glsa/202405-11
RHSA-2021:3576 https://access.redhat.com/errata/RHSA-2021:3576
USN-5959-1 https://usn.ubuntu.com/5959-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-36222.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-36222
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-36222
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2021-36222
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N Found at https://www.oracle.com/security-alerts/cpuoct2021.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.85638
EPSS Score 0.01199
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.