Search for vulnerabilities
Vulnerability details: VCID-htwj-z8xz-puh7
Vulnerability ID VCID-htwj-z8xz-puh7
Aliases CVE-2025-3576
Summary A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering.
Status Published
Exploitability 0.5
Weighted Severity 5.3
Risk 2.6
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-328 Use of Weak Hash
System Score Found at
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:11487
ssvc Track https://access.redhat.com/errata/RHSA-2025:11487
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:13664
ssvc Track https://access.redhat.com/errata/RHSA-2025:13664
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:13777
ssvc Track https://access.redhat.com/errata/RHSA-2025:13777
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:15000
ssvc Track https://access.redhat.com/errata/RHSA-2025:15000
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:15001
ssvc Track https://access.redhat.com/errata/RHSA-2025:15001
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:15002
ssvc Track https://access.redhat.com/errata/RHSA-2025:15002
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:15003
ssvc Track https://access.redhat.com/errata/RHSA-2025:15003
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:15004
ssvc Track https://access.redhat.com/errata/RHSA-2025:15004
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:8411
ssvc Track https://access.redhat.com/errata/RHSA-2025:8411
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:9418
ssvc Track https://access.redhat.com/errata/RHSA-2025:9418
cvssv3.1 5.9 https://access.redhat.com/errata/RHSA-2025:9430
ssvc Track https://access.redhat.com/errata/RHSA-2025:9430
cvssv3 5.9 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3576.json
cvssv3.1 5.9 https://access.redhat.com/security/cve/CVE-2025-3576
ssvc Track https://access.redhat.com/security/cve/CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00021 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.0003 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00031 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00038 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00046 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
epss 0.00047 https://api.first.org/data/v1/epss?cve=CVE-2025-3576
cvssv3.1 5.9 https://bugzilla.redhat.com/show_bug.cgi?id=2359465
ssvc Track https://bugzilla.redhat.com/show_bug.cgi?id=2359465
cvssv3.1 5.9 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 5.9 https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html
ssvc Track https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3576.json
https://api.first.org/data/v1/epss?cve=CVE-2025-3576
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-3576
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://lists.debian.org/debian-lts-announce/2025/05/msg00047.html
1103525 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1103525
cpe:/a:redhat:ansible_automation_platform:2 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:ansible_automation_platform:2
cpe:/a:redhat:discovery:2::el9 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:discovery:2::el9
cpe:/a:redhat:enterprise_linux:9::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:openshift:4 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:openshift:4
cpe:/a:redhat:rhel_e4s:9.0::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:9.0::appstream
cpe:/a:redhat:rhel_e4s:9.2::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_eus:9.4::appstream https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/a:redhat:rhel_eus:9.4::appstream
cpe:/o:redhat:enterprise_linux:10.0 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:10.0
cpe:/o:redhat:enterprise_linux:6 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7 https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:8::baseos
cpe:/o:redhat:enterprise_linux:9::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:enterprise_linux:9::baseos
cpe:/o:redhat:rhel_aus:8.2::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_aus:8.2::baseos
cpe:/o:redhat:rhel_aus:8.4::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_aus:8.4::baseos
cpe:/o:redhat:rhel_aus:8.6::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_aus:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.6::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_e4s:8.6::baseos
cpe:/o:redhat:rhel_e4s:8.8::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_e4s:8.8::baseos
cpe:/o:redhat:rhel_e4s:9.0::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_e4s:9.0::baseos
cpe:/o:redhat:rhel_e4s:9.2::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_e4s:9.2::baseos
cpe:/o:redhat:rhel_eus:9.4::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_eus:9.4::baseos
cpe:/o:redhat:rhel_eus_long_life:8.4::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_eus_long_life:8.4::baseos
cpe:/o:redhat:rhel_tus:8.6::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_tus:8.6::baseos
cpe:/o:redhat:rhel_tus:8.8::baseos https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:/o:redhat:rhel_tus:8.8::baseos
CVE-2025-3576 https://access.redhat.com/security/cve/CVE-2025-3576
CVE-2025-3576 https://nvd.nist.gov/vuln/detail/CVE-2025-3576
krb5-1.22.html https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html
RHSA-2025:11487 https://access.redhat.com/errata/RHSA-2025:11487
RHSA-2025:13664 https://access.redhat.com/errata/RHSA-2025:13664
RHSA-2025:13777 https://access.redhat.com/errata/RHSA-2025:13777
RHSA-2025:15000 https://access.redhat.com/errata/RHSA-2025:15000
RHSA-2025:15001 https://access.redhat.com/errata/RHSA-2025:15001
RHSA-2025:15002 https://access.redhat.com/errata/RHSA-2025:15002
RHSA-2025:15003 https://access.redhat.com/errata/RHSA-2025:15003
RHSA-2025:15004 https://access.redhat.com/errata/RHSA-2025:15004
RHSA-2025:8411 https://access.redhat.com/errata/RHSA-2025:8411
RHSA-2025:9418 https://access.redhat.com/errata/RHSA-2025:9418
RHSA-2025:9430 https://access.redhat.com/errata/RHSA-2025:9430
show_bug.cgi?id=2359465 https://bugzilla.redhat.com/show_bug.cgi?id=2359465
USN-7542-1 https://usn.ubuntu.com/7542-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:11487
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:11487
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:13664
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:13664
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:13777
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:13777
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:15000
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:15000
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:15001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:15001
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:15002
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:15002
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:15003
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:15003
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:15004
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:15004
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:8411
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:8411
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:9418
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:9418
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/errata/RHSA-2025:9430
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/errata/RHSA-2025:9430
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-3576.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://access.redhat.com/security/cve/CVE-2025-3576
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://access.redhat.com/security/cve/CVE-2025-3576
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359465
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://bugzilla.redhat.com/show_bug.cgi?id=2359465
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-15T13:11:53Z/ Found at https://web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.03964
EPSS Score 0.00021
Published At July 30, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-07-31T08:54:34.716874+00:00 Ubuntu USN Importer Import https://usn.ubuntu.com/7542-1/ 37.0.0