Krb5: kerberos rc4-hmac-md5 checksum vulnerability enabling message spoofing via md5 collisions
Summary
| CVE | CVE-2025-3576 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2025-04-15 06:15:44 UTC |
| Updated | 2026-05-12 13:17:18 UTC |
| Description | A vulnerability in the MIT Kerberos implementation allows GSSAPI-protected messages using RC4-HMAC-MD5 to be spoofed due to weaknesses in the MD5 checksum design. If RC4 is preferred over stronger encryption types, an attacker could exploit MD5 collisions to forge message integrity codes. This may lead to unauthorized message tampering. |
Risk And Classification
Primary CVSS: v3.1 5.9 MEDIUM from [email protected]
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS: 0.002320000 probability, percentile 0.459120000 (date 2026-05-12)
Problem Types: CWE-328 | CWE-328 Use of Weak Hash
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Secondary | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
| 3.1 | CNA | CVSS | 5.9 | MEDIUM | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
HighPrivileges Required
NoneUser Interaction
NoneScope
UnchangedConfidentiality
NoneIntegrity
HighAvailability
NoneCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Red Hat | Red Hat Enterprise Linux 10 | unaffected 0:1.21.3-8.el10_0 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8 | unaffected 0:1.18.2-32.el8_10 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.2 Advanced Update Support | unaffected 0:1.17-19.el8_2.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | unaffected 0:1.18.2-9.el8_4.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | unaffected 0:1.18.2-9.el8_4.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | unaffected 0:1.18.2-16.el8_6.4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Telecommunications Update Service | unaffected 0:1.18.2-16.el8_6.4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.6 Update Services For SAP Solutions | unaffected 0:1.18.2-16.el8_6.4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | unaffected 0:1.18.2-26.el8_8.5 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 8.8 Update Services For SAP Solutions | unaffected 0:1.18.2-26.el8_8.5 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:1.21.1-8.el9_6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9 | unaffected 0:1.21.1-8.el9_6 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.0 Update Services For SAP Solutions | unaffected 0:1.19.1-16.el9_0.4 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions | unaffected 0:1.20.1-9.el9_2.3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 9.4 Extended Update Support | unaffected 0:1.21.1-2.el9_4.2 * rpm | Not specified |
| CNA | Red Hat | Red Hat Discovery 2 | unaffected sha256:c499a099e03c7488ffe50529a34723ade191a89fcfc59d1f0edd01db2b579ca3 * rpm | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 6 | Not specified | Not specified |
| CNA | Red Hat | Red Hat Enterprise Linux 7 | Not specified | Not specified |
| CNA | Red Hat | Red Hat OpenShift Container Platform 4 | Not specified | Not specified |
| ADP | Siemens | RUGGEDCOM ROX MX5000 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX MX5000RE | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX1400 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX1500 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX1501 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX1510 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX1511 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX1512 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX1524 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX1536 | affected V2.17.1 custom | Not specified |
| ADP | Siemens | RUGGEDCOM ROX RX5000 | affected V2.17.1 custom | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| access.redhat.com/errata/RHSA-2025:15001 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2025:15000 | [email protected] | access.redhat.com | |
| lists.debian.org/debian-lts-announce/2025/05/msg00047.html | af854a3a-2127-422b-91ae-364da2661108 | lists.debian.org | |
| access.redhat.com/errata/RHSA-2025:15003 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2025:13664 | [email protected] | access.redhat.com | |
| web.mit.edu/kerberos/krb5-1.22/krb5-1.22.html | [email protected] | web.mit.edu | |
| access.redhat.com/errata/RHSA-2025:13777 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2025:9430 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2025:11487 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2025:8411 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2025:15002 | [email protected] | access.redhat.com | |
| access.redhat.com/security/cve/CVE-2025-3576 | [email protected] | access.redhat.com | |
| cert-portal.siemens.com/productcert/html/ssa-577017.html | 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e | cert-portal.siemens.com | |
| access.redhat.com/errata/RHSA-2025:15004 | [email protected] | access.redhat.com | |
| access.redhat.com/errata/RHSA-2025:9418 | [email protected] | access.redhat.com | |
| bugzilla.redhat.com/show_bug.cgi | [email protected] | bugzilla.redhat.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2025-04-14T11:00:53.484Z | Reported to Red Hat. |
| CNA | 2025-04-15T00:00:00.000Z | Made public. |
Workarounds
CNA: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
There are currently no legacy QID mappings associated with this CVE.