CVE-2023-39975 - Vulnerability Details - OpenCVE

kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Mit	Kerberos 5
Redhat	Enterprise Linux

Configuration 1 [-]

cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
krb5-0:1.21.1-1.el9	cpe:/a:redhat:enterprise_linux:9	RHSA-2023:6699	2023-11-07T00:00:00Z
krb5-0:1.21.1-1.el9	cpe:/o:redhat:enterprise_linux:9	RHSA-2023:6699	2023-11-07T00:00:00Z

References

Link	Providers
https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840
https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final
https://nvd.nist.gov/vuln/detail/CVE-2023-39975
https://security.netapp.com/advisory/ntap-20230915-0014/
https://security.netapp.com/advisory/ntap-20240201-0005/
https://security.netapp.com/advisory/ntap-20240201-0008/
https://web.mit.edu/kerberos/www/advisories/
https://www.cve.org/CVERecord?id=CVE-2023-39975

History

Thu, 26 Feb 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: mitre

Published: 2023-08-16T00:00:00.000Z

Updated: 2026-02-25T17:20:11.934Z

Reserved: 2023-08-07T00:00:00.000Z

Link: CVE-2023-39975

Vulnrichment

Updated: 2024-08-02T18:18:10.190Z

NVD

Status : Modified

Published: 2023-08-16T15:15:11.277

Modified: 2026-02-25T18:17:00.820

Link: CVE-2023-39975

Redhat

Severity : Moderate

Publid Date: 2023-08-16T00:00:00Z

Links: CVE-2023-39975 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-39975", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2026-02-25T17:20:11.934Z", "dateReserved": "2023-08-07T00:00:00.000Z", "datePublished": "2023-08-16T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-02-01T17:06:58.025Z"}, "descriptions": [{"lang": "en", "value": "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://web.mit.edu/kerberos/www/advisories/"}, {"url": "https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final"}, {"url": "https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840"}, {"url": "https://security.netapp.com/advisory/ntap-20230915-0014/"}, {"url": "https://security.netapp.com/advisory/ntap-20240201-0008/"}, {"url": "https://security.netapp.com/advisory/ntap-20240201-0005/"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:10.190Z"}, "title": "CVE Program Container", "references": [{"url": "https://web.mit.edu/kerberos/www/advisories/", "tags": ["x_transferred"]}, {"url": "https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final", "tags": ["x_transferred"]}, {"url": "https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230915-0014/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240201-0008/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240201-0005/", "tags": ["x_transferred"]}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-39975", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-15T05:16:00.473844Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T17:20:11.934Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://web.mit.edu/kerberos/www/advisories/", "tags": ["x_transferred"]}, {"url": "https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final", "tags": ["x_transferred"]}, {"url": "https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230915-0014/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240201-0008/", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20240201-0005/", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T18:18:10.190Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-39975", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-02-15T05:16:00.473844Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T17:14:46.268Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://web.mit.edu/kerberos/www/advisories/"}, {"url": "https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final"}, {"url": "https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840"}, {"url": "https://security.netapp.com/advisory/ntap-20230915-0014/"}, {"url": "https://security.netapp.com/advisory/ntap-20240201-0008/"}, {"url": "https://security.netapp.com/advisory/ntap-20240201-0005/"}], "descriptions": [{"lang": "en", "value": "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-02-01T17:06:58.025Z"}}}, "cveMetadata": {"cveId": "CVE-2023-39975", "state": "PUBLISHED", "dateUpdated": "2026-02-25T17:20:11.934Z", "dateReserved": "2023-08-07T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2023-08-16T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mit:kerberos_5:*:*:*:*:*:*:*:*", "matchCriteriaId": "BA50866D-BAAB-46DD-A6AC-8F8539414285", "versionEndExcluding": "1.21.2", "versionStartIncluding": "1.21", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "kdc/do_tgs_req.c in MIT Kerberos 5 (aka krb5) 1.21 before 1.21.2 has a double free that is reachable if an authenticated user can trigger an authorization-data handling failure. Incorrect data is copied from one ticket to another."}, {"lang": "es", "value": "kdc/do_tgs_req.c en MIT Kerberos 5 (tambi\u00e9n conocido como krb5) 1.21 antes de 1.21.2 tiene un double free que es accesible si un usuario autenticado puede desencadenar un error de gesti\u00f3n de datos de autorizaci\u00f3n. Los datos incorrectos se copian de un ticket a otro."}], "id": "CVE-2023-39975", "lastModified": "2026-02-25T18:17:00.820", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2023-08-16T15:15:11.277", "references": [{"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840"}, {"source": "cve@mitre.org", "tags": ["Patch"], "url": "https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20230915-0014/"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20240201-0005/"}, {"source": "cve@mitre.org", "url": "https://security.netapp.com/advisory/ntap-20240201-0008/"}, {"source": "cve@mitre.org", "tags": ["Vendor Advisory"], "url": "https://web.mit.edu/kerberos/www/advisories/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/krb5/krb5/commit/88a1701b423c13991a8064feeb26952d3641d840"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/krb5/krb5/compare/krb5-1.21.1-final...krb5-1.21.2-final"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20230915-0014/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240201-0005/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://security.netapp.com/advisory/ntap-20240201-0008/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://web.mit.edu/kerberos/www/advisories/"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-415"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}