CVE-2015-3206
Summary
| CVE | CVE-2015-3206 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2017-08-25 18:29:00 UTC |
|---|
| Updated | 2018-12-20 18:11:00 UTC |
|---|
| Description | The checkPassword function in python-kerberos does not authenticate the KDC it attempts to communicate with, which allows remote attackers to cause a denial of service (bad response), or have other unspecified impact by performing a man-in-the-middle attack. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| kerberos 1.1.1 : Python Package Index |
CONFIRM |
pypi.python.org |
Patch, Vendor Advisory |
| Bug 1223802 – CVE-2015-3206 python-kerberos: checkPassword() does not verify KDC authenticity |
CONFIRM |
bugzilla.redhat.com |
Issue Tracking, Patch, Third Party Advisory |
| checkPassword is insecure · Issue #31 · apple/ccs-pykerberos · GitHub |
CONFIRM |
github.com |
Issue Tracking, Patch, Third Party Advisory |
| oss-security - CVE-2015-3206 python-kerberos: checkPassword() does not verify KDC authenticity |
MLIST |
www.openwall.com |
Mailing List, Patch, Third Party Advisory |
| python-kerberos 'checkPassword()' Function Man in the Middle Information Disclosure Vulnerability |
BID |
www.securityfocus.com |
Third Party Advisory, VDB Entry |
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 997505 Python (Pip) Security Update for kerberos (GHSA-mffc-9gx5-99g3)
