CVE-2018-5729

MediumCVSS 4.7/10Last modified Jun 17, 2026

Description

MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to cause a denial of service (NULL pointer dereference) or bypass a DN container check by supplying tagged data that is internal to the database module.

Metrics

CVSS 3.1 4.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-476

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Mar 6, 2018
Last modified
Jun 17, 2026
NVD status
Undergoing Analysis

Related CVEs from 2018

CVE-2018-57303.8MIT krb5 1.6 or later allows an authenticated kadmin with permission to add principals to an LDAP Kerberos database to circumvent a DN contaCVE-2018-57317.0An issue was discovered in Heimdal PRO 2.2.190. As part of the scanning feature, a process called md.hs writes an executable called CS1.tmp CVE-2018-57327.5Failure to properly bounds-check a buffer used for processing DHCP options allows a malicious server (or an entity masquerading as a server)CVE-2018-57337.5A malicious client which is allowed to send very large amounts of traffic (billions of packets) to a DHCP server can eventually overflow a 3CVE-2018-57347.5While handling a particular type of malformed packet BIND erroneously selects a SERVFAIL rcode instead of a FORMERR rcode. If the receiving CVE-2018-57357.5The Debian backport of the fix for CVE-2017-3137 leads to assertion failure in validator.c:1858; Affects Debian versions 9.9.5.dfsg-9+deb8u1CVE-2018-57365.3An error in zone database reference counting can lead to an assertion failure if a server which is running an affected version of BIND attemCVE-2018-57377.5A problem with the implementation of the new serve-stale feature in BIND 9.12 can lead to an assertion failure in rbtdb.c, even when stale-aCVE-2018-57387.5Change #4777 (introduced in October 2017) introduced an unforeseen issue in releases which were issued after that date, affecting which clieCVE-2018-57397.5An extension to hooks capabilities which debuted in Kea 1.4.0 introduced a memory leak for operators who are using certain hooks library facCVE-2018-57407.5"deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, CVE-2018-57416.5To provide fine-grained controls over the ability to use Dynamic DNS (DDNS) to update records in a zone, BIND 9 provides a feature called up