CVE catalog

CVE-2023-3326

libpam-krb5: CVE-2023-3326

Severity: Low
Published: Jun 20, 2023, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 1.10% · Oct 25, 2026

pam_krb5 authenticates a user by essentially running kinit with the password, getting a ticket-granting ticket (tgt) from the Kerberos KDC (Key Distribution Center) over the network, as a way to verify the password. However, if a keytab is not provisioned on the system, pam_krb5 has no way to validate the response from the KDC, and essentially trusts the tgt provided over the network as being valid. In a non-default FreeBSD installation that leverages pam_krb5 for authentication and does not have a keytab provisioned, an attacker that is able to control both the password and the KDC responses can return a valid tgt, allowing authentication to occur for any user on the system.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	libpam-krb5	sid	`4.11-2`	vulnerable
Debian	libpam-krb5	forky	`4.11-2`	vulnerable
Debian	libpam-krb5	trixie	`4.11-2`	vulnerable
Debian	libpam-krb5	bookworm	`4.11-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	libpam-krb5	source	sid	`(unfixed)`	unimportant	Not reported	Not reported
Debian	libpam-krb5	source	forky	`(unfixed)`	unimportant	Not reported	Not reported
Debian	libpam-krb5	source	trixie	`(unfixed)`	unimportant	Not reported	Not reported
Debian	libpam-krb5	source	bookworm	`(unfixed)`	unimportant	Not reported	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [SUSE security advisories and VEX]