| Name | CVE-2015-3206 |
| Description | The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-265-1, DLA-265-2 |
| Debian Bugs | 796195 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| pykerberos (PTS) | buster | 1.1.14-2 | fixed |
| sid, trixie, bookworm, bullseye | 1.1.14-3.1 | fixed |
The information below is based on the following data on fixed versions.
Notes
CVE originally assigned for python-kerberos, pykerberos is a fork of the
former.
KDC verification support in pykerberos added in https://github.com/02strich/pykerberos/commit/02d13860b25fab58e739f0e000bed0067b7c6f9c
Using the above code as is might break existing installations since a keytab is required to call krb5_verify_init_creds