Search for vulnerabilities
Vulnerability details: VCID-uzwh-v7yj-aaak
Vulnerability ID VCID-uzwh-v7yj-aaak
Aliases CVE-2017-15088
Summary plugins/preauth/pkinit/pkinit_crypto_openssl.c in MIT Kerberos 5 (aka krb5) through 1.15.2 mishandles Distinguished Name (DN) fields, which allows remote attackers to execute arbitrary code or cause a denial of service (buffer overflow and application crash) in situations involving untrusted X.509 data, related to the get_matching_data and X509_NAME_oneline_ex functions. NOTE: this has security relevance only in use cases outside of the MIT Kerberos distribution, e.g., the use of get_matching_data in KDC certauth plugin code that is specific to Red Hat.
Status Published
Exploitability 0.5
Weighted Severity 9.0
Risk 4.5
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-121 Stack-based Buffer Overflow
System Score Found at
generic_textual Negligible http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15088.html
cvssv3 7.1 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15088.json
epss 0.01283 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01283 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01283 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01283 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01283 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01283 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01283 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.01351 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02055 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02725 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02725 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02725 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.02725 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.0399 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.0399 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
epss 0.05075 https://api.first.org/data/v1/epss?cve=CVE-2017-15088
generic_textual Negligible https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15088
cvssv2 7.1 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
generic_textual Negligible https://github.com/krb5/krb5/pull/707
cvssv2 7.5 https://nvd.nist.gov/vuln/detail/CVE-2017-15088
cvssv3 9.8 https://nvd.nist.gov/vuln/detail/CVE-2017-15088
cvssv3.1 9.8 https://nvd.nist.gov/vuln/detail/CVE-2017-15088
archlinux Critical https://security.archlinux.org/AVG-505
Reference id Reference type URL
http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-15088.html
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15088.json
https://api.first.org/data/v1/epss?cve=CVE-2017-15088
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=871698
https://bugzilla.redhat.com/show_bug.cgi?id=1504045
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-15088
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/krb5/krb5/commit/fbb687db1088ddd894d975996e5f6a4252b9a2b4
https://github.com/krb5/krb5/pull/707
http://www.securityfocus.com/bid/101594
AVG-505 https://security.archlinux.org/AVG-505
cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*
CVE-2017-15088 https://nvd.nist.gov/vuln/detail/CVE-2017-15088
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-15088.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:H/Au:S/C:C/I:C/A:C Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2017-15088
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-15088
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2017-15088
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.78602
EPSS Score 0.01283
Published At June 9, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.