Search for vulnerabilities
Vulnerability details: VCID-7r8c-ac4p-5kfz
Vulnerability ID VCID-7r8c-ac4p-5kfz
Aliases CVE-2025-3576
Summary A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.
Status Published
Exploitability 0.5
Weighted Severity 5.3
Risk 2.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-328 Use of Weak Hash
System Score Found at
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:8411
ssvc Track https://access.redhat.com/errata/RHSA-2025:8411
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:9418
ssvc Track https://access.redhat.com/errata/RHSA-2025:9418
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:9430
ssvc Track https://access.redhat.com/errata/RHSA-2025:9430
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3576.json
cvssv3.1 5.9 https://access.redhat.com/security/cve/CVE-2025-3576
ssvc Track https://access.redhat.com/security/cve/CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0001 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00012 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00014 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00015 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00022 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 9e-05 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
cvssv3.1 5.9 https://bugzilla.redhat.com/show_bug.cgi?id=2359465
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2359465
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2025-3576
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3576.json
https://access.redhat.com/security/cve/CVE-2025-3576
https://api.first.org/data/v1/epss?cve=CVE-2025-3576
https://bugzilla.redhat.com/show_bug.cgi?id=2359465
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3576
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2025/05/msg00047.html
1103525 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103525
cpe:/a:redhat:ansible_automation_platform:2 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform:2
cpe:/a:redhat:enterprise_linux:9::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:openshift:4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:10.0 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10.0
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:8::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/o:redhat:enterprise_linux:9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9
cpe:/o:redhat:enterprise_linux:9::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9::baseos
CVE-2025-3576 https://nvd.nist.gov/vuln/detail/CVE-2025-3576
RHSA-2025:8411 https://access.redhat.com/errata/RHSA-2025:8411
RHSA-2025:9418 https://access.redhat.com/errata/RHSA-2025:9418
RHSA-2025:9430 https://access.redhat.com/errata/RHSA-2025:9430
USN-7542-1 https://usn.ubuntu.com/7542-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:8411
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:8411
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:9418
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:9418
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:9430
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:9430
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3576.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2025-3576
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/security/cve/CVE-2025-3576
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359465
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359465
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-3576
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.00751
EPSS Score 0.0001
Published At May 22, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-04-15T08:08:45.163372+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2025-3576 36.0.0