Search for vulnerabilities
Vulnerability details: VCID-qr91-uuuy-aaas
Vulnerability ID VCID-qr91-uuuy-aaas
Aliases CVE-2022-42898
Summary PAC parsing in MIT Kerberos 5 (aka krb5) before 1.19.4 and 1.20.x before 1.20.1 has integer overflows that may lead to remote code execution (in KDC, kadmind, or a GSS or Kerberos application server) on 32-bit platforms (which have a resultant heap-based buffer overflow), and cause a denial of service on other platforms. This occurs in krb5_pac_parse in lib/krb5/krb/pac.c. Heimdal before 7.7.1 has "a similar bug."
Status Published
Exploitability 0.5
Weighted Severity 7.9
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-190 Integer Overflow or Wraparound
System Score Found at
cvssv3 8.8 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-42898.json
epss 0.00980 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.00980 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.00980 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.00980 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.00980 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.00980 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.00980 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.00980 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.01092 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.01092 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.01092 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.01715 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.01715 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.01715 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.01715 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.05227 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.06859 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
epss 0.17854 https://api.first.org/data/v1/epss?cve=CVE-2022-42898
cvssv3.1 8.8 https://bugzilla.samba.org/show_bug.cgi?id=15203
ssvc Track https://bugzilla.samba.org/show_bug.cgi?id=15203
generic_textual Low https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
cvssv3.1 6.4 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1 8.8 https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
ssvc Track https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
cvssv3.1 8.8 https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
ssvc Track https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
cvssv3 8.8 https://nvd.nist.gov/vuln/detail/CVE-2022-42898
cvssv3.1 8.8 https://nvd.nist.gov/vuln/detail/CVE-2022-42898
archlinux Unknown https://security.archlinux.org/AVG-2828
cvssv3.1 8.8 https://security.gentoo.org/glsa/202309-06
ssvc Track https://security.gentoo.org/glsa/202309-06
cvssv3.1 8.8 https://security.gentoo.org/glsa/202310-06
ssvc Track https://security.gentoo.org/glsa/202310-06
cvssv3.1 8.8 https://security.netapp.com/advisory/ntap-20230216-0008/
ssvc Track https://security.netapp.com/advisory/ntap-20230216-0008/
cvssv3.1 8.8 https://security.netapp.com/advisory/ntap-20230223-0001/
ssvc Track https://security.netapp.com/advisory/ntap-20230223-0001/
cvssv3.1 8.8 https://web.mit.edu/kerberos/advisories/
ssvc Track https://web.mit.edu/kerberos/advisories/
cvssv3.1 8.8 https://web.mit.edu/kerberos/krb5-1.19/
ssvc Track https://web.mit.edu/kerberos/krb5-1.19/
cvssv3.1 8.8 https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
ssvc Track https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
cvssv3.1 8.8 https://www.samba.org/samba/security/CVE-2022-42898.html
ssvc Track https://www.samba.org/samba/security/CVE-2022-42898.html
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-42898.json
https://api.first.org/data/v1/epss?cve=CVE-2022-42898
https://bugzilla.samba.org/show_bug.cgi?id=15203
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3671
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44758
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-3437
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41916
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-42898
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-44640
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
https://security.gentoo.org/glsa/202309-06
https://security.netapp.com/advisory/ntap-20230216-0008/
https://security.netapp.com/advisory/ntap-20230223-0001/
https://web.mit.edu/kerberos/advisories/
https://web.mit.edu/kerberos/krb5-1.19/
https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
https://www.samba.org/samba/security/CVE-2022-42898.html
1024187 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1024187
2140960 https://bugzilla.redhat.com/show_bug.cgi?id=2140960
AVG-2828 https://security.archlinux.org/AVG-2828
cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:heimdal_project:heimdal:*:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.20:-:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mit:kerberos_5:1.20:-:*:*:*:*:*:*
cpe:2.3:a:mit:kerberos_5:1.20:beta1:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mit:kerberos_5:1.20:beta1:*:*:*:*:*:*
cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*
CVE-2022-42898 https://nvd.nist.gov/vuln/detail/CVE-2022-42898
GLSA-202310-06 https://security.gentoo.org/glsa/202310-06
GLSA-202405-11 https://security.gentoo.org/glsa/202405-11
RHSA-2022:8637 https://access.redhat.com/errata/RHSA-2022:8637
RHSA-2022:8638 https://access.redhat.com/errata/RHSA-2022:8638
RHSA-2022:8639 https://access.redhat.com/errata/RHSA-2022:8639
RHSA-2022:8640 https://access.redhat.com/errata/RHSA-2022:8640
RHSA-2022:8641 https://access.redhat.com/errata/RHSA-2022:8641
RHSA-2022:8648 https://access.redhat.com/errata/RHSA-2022:8648
RHSA-2022:8662 https://access.redhat.com/errata/RHSA-2022:8662
RHSA-2022:8663 https://access.redhat.com/errata/RHSA-2022:8663
RHSA-2022:8669 https://access.redhat.com/errata/RHSA-2022:8669
RHSA-2022:9029 https://access.redhat.com/errata/RHSA-2022:9029
USN-5800-1 https://usn.ubuntu.com/5800-1/
USN-5822-1 https://usn.ubuntu.com/5822-1/
USN-5828-1 https://usn.ubuntu.com/5828-1/
USN-5936-1 https://usn.ubuntu.com/5936-1/
USN-7582-1 https://usn.ubuntu.com/7582-1/
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2022-42898.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://bugzilla.samba.org/show_bug.cgi?id=15203
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://bugzilla.samba.org/show_bug.cgi?id=15203
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://github.com/heimdal/heimdal/security/advisories/GHSA-64mq-fvfj-5x3c
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://github.com/krb5/krb5/commit/ea92d2f0fcceb54a70910fa32e9a0d7a5afc3583
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-42898
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2022-42898
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202309-06
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://security.gentoo.org/glsa/202309-06
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.gentoo.org/glsa/202310-06
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://security.gentoo.org/glsa/202310-06
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20230216-0008/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://security.netapp.com/advisory/ntap-20230216-0008/
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://security.netapp.com/advisory/ntap-20230223-0001/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://security.netapp.com/advisory/ntap-20230223-0001/
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://web.mit.edu/kerberos/advisories/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://web.mit.edu/kerberos/advisories/
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://web.mit.edu/kerberos/krb5-1.19/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://web.mit.edu/kerberos/krb5-1.19/
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://web.mit.edu/kerberos/krb5-1.20/README-1.20.1.txt
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://www.samba.org/samba/security/CVE-2022-42898.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:T/P:M/B:A/M:M/D:T/2025-04-14T16:11:12Z/ Found at https://www.samba.org/samba/security/CVE-2022-42898.html
Exploit Prediction Scoring System (EPSS)
Percentile 0.83878
EPSS Score 0.00980
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
There are no relevant records.