Skip to content
Fencer Vulns
medium 5.3

CVE-2018-20217 json

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17.

published 2018-12-26 7 y ago modified 2026-06-17 4 mo ago also EUVD-2018-12784

cvss
5.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
1.4%
EPSS 1.4% chance of exploitation in 30 days, percentile 72%
public exploits
0
none known

Summary

A Reachable Assertion issue was discovered in the KDC in MIT Kerberos 5 (aka krb5) before 1.17. If an attacker can obtain a krbtgt ticket using an older encryption type (single-DES, triple-DES, or RC4), the attacker can crash the KDC by making an S4U2Self request.

Patch / fix

  • mit kerberos_5 1.17
  • mit krb5 1.17
  • krb5 Debian 14, Debian 13, Debian 12 1.16.2-1

debian advisories DEBIAN-CVE-2018-20217

  • krb5 Ubuntu 18.04 LTS 1.16-2ubuntu0.3
  • krb5 Ubuntu Pro 14.04 LTS 1.12+dfsg-2ubuntu5.4+esm1
  • krb5 Ubuntu Pro 16.04 LTS 1.13.2+dfsg-5ubuntu2.2+esm3

ubuntu advisories UBUNTU-CVE-2018-20217

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • krb5 RHEL 7 1.15.1-37.el7_7.2
  • libkadm5 RHEL 7 1.15.1-37.el7_7.2
  • krb5-libs RHEL 7 1.15.1-37.el7_7.2
  • krb5-pkinit RHEL 7 1.15.1-37.el7_7.2
  • krb5-server RHEL 7 1.15.1-37.el7_7.2
  • krb5-server-ldap RHEL 7 1.15.1-37.el7_7.2
  • krb5-workstation RHEL 7 1.15.1-37.el7_7.2

red hat advisories RHBA-2019:2599

  • krb5 SLES for SAP 12 SP4, SLES for SAP 12 SP3, SLES for SAP 12 SP2 +10 more 1.12.5-40.31.1
  • krb5 SLES for SAP 12 SP1, SLES 12-LTSS, SLES 12 SP1-LTSS 1.12.1-38.13.2

suse advisories SUSE-SU-2019:0113-2SUSE-SU-2019:0113-1SUSE-SU-2019:0111-1

  • krb5 openSUSE Tumbleweed 1.19.2-3.1
  • krb5 openSUSE Leap 15.0 1.15.2-lp150.5.3.1
  • krb5-mini openSUSE Leap 15.0 1.15.2-lp150.5.3.1

opensuse advisories openSUSE-SU-2024:11549-1openSUSE-SU-2019:0063-1

  • krb5 Alpine 3.24, Alpine 3.23, Alpine 3.22 +15 more 1.15.4-r0
  • krb5 Alpine 3.6 1.14.3-r3

alpine advisories ALPINE-CVE-2018-20217

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2018-20217 updated cvss 5.3

krb5: Reachable assertion in the KDC using S4U2Self requests

  • Red Hat Enterprise Linux 6 krb5, libkadm5, krb5-libs, krb5-server, krb5-server-ldap, krb5-workstation, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat JBoss Core Services krb5 Red Hat JBoss Enterprise Application Platform 6 krb5 Red Hat JBoss Enterprise Web Server 2 krb5
    affected: no fix planned “Out of support scope”
  • Red Hat Ansible Tower 3.4 for RHEL 7 Server ansible-tower-34/ansible-tower-memcached 1.4.15-28, ansible-tower-35/ansible-tower-memcached 1.4.15-28, ansible-tower-37/ansible-tower-memcached-rhel7 1.4.15-28
    fixed: vendor fix RHBA-2020:0547
  • Red Hat Enterprise Linux Client (v. 7) krb5 1.15.1-37.el7_7.2, libkadm5 1.15.1-37.el7_7.2, krb5-libs 1.15.1-37.el7_7.2, krb5-pkinit 1.15.1-37.el7_7.2, krb5-workstation 1.15.1-37.el7_7.2 Red Hat Enterprise Linux Client Optional (v. 7) krb5-server 1.15.1-37.el7_7.2, krb5-server-ldap 1.15.1-37.el7_7.2 Red Hat Enterprise Linux ComputeNode (v. 7) krb5 1.15.1-37.el7_7.2, libkadm5 1.15.1-37.el7_7.2, krb5-libs 1.15.1-37.el7_7.2, krb5-pkinit 1.15.1-37.el7_7.2, krb5-workstation 1.15.1-37.el7_7.2 Red Hat Enterprise Linux ComputeNode Optional (v. 7) krb5-server 1.15.1-37.el7_7.2, krb5-server-ldap 1.15.1-37.el7_7.2 Red Hat Enterprise Linux Server (v. 7) krb5 1.15.1-37.el7_7.2, libkadm5 1.15.1-37.el7_7.2, krb5-libs 1.15.1-37.el7_7.2, krb5-pkinit 1.15.1-37.el7_7.2, krb5-server 1.15.1-37.el7_7.2, krb5-server-ldap 1.15.1-37.el7_7.2, +1 more Red Hat Enterprise Linux Workstation (v. 7) krb5 1.15.1-37.el7_7.2, libkadm5 1.15.1-37.el7_7.2, krb5-libs 1.15.1-37.el7_7.2, krb5-pkinit 1.15.1-37.el7_7.2, krb5-server 1.15.1-37.el7_7.2, krb5-server-ldap 1.15.1-37.el7_7.2, +1 more
    fixed: vendor fix RHBA-2019:2599
  • Red Hat Enterprise Linux 5 krb5 Red Hat Enterprise Linux 8 krb5, libkadm5, krb5-libs, krb5-pkinit, krb5-server, krb5-server-ldap, +1 more
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.42% chance of exploitation in the next 30 days, higher than 72% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
NVD 2.0 3.5 AV:N/AC:M/Au:S/C:N/I:N/A:P

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Improve kerberos 5 affected range consistency.