By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
| Vendor | Product | Versions |
|---|---|---|
| apache | kerby | 0 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| ibm | infosphere information | cert_advisory | 90% |
Updated severity to MEDIUM, added affected versions before 2.1.2, marked exploit as available.
Updated description with new details, changed severity to HIGH, added affected version 2.1.1, and noted that no exploit is available.
Initial creation
