It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending a PA-DATA with an unrecognized or unsupported type. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
| Vendor | Product | Versions |
|---|---|---|
| apache | kerby | 0 |
Updated severity to CRITICAL, added affected version 2.1.1, and marked the vulnerability as actively exploited.
Initial creation
