CVE-2017-7562

Name: CVE-2017-7562
Creator: NVD / NIST
Published: 2018-07-26T15:29:00.403+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.5/10EPSS 3.30%

Last modified Jun 17, 2026

CVE-2017-7562 is a medium-severity vulnerability rated 6.5/10 on the CVSS scale. An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.. EPSS estimates a 3.30% chance of exploitation in the next 30 days.

Description

An authentication bypass flaw was found in the way krb5's certauth interface before 1.16.1 handled the validation of client certificates. A remote attacker able to communicate with the KDC could potentially use this flaw to impersonate arbitrary principals under rare and erroneous circumstances.

Metrics

CVSS 3.1

6.5/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS Probability

3.30%

87.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Redhat	Enterprise Linux	7.0
Redhat	Enterprise Linux Desktop	7.0
Redhat	Enterprise Linux Server	7.0
Redhat	Enterprise Linux Workstation	7.0
Mit	Kerberos 5	>= 1.0, < 1.16.1

References

http://www.securityfocus.com/bid/100511Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0666Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7562Issue Tracking, Patch, Third Party Advisory
https://github.com/krb5/krb5/pull/694Patch, Third Party Advisory
https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196Third Party Advisory
https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2Third Party Advisory
https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627dThird Party Advisory
http://www.securityfocus.com/bid/100511Third Party Advisory, VDB Entry
https://access.redhat.com/errata/RHSA-2018:0666Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-7562Issue Tracking, Patch, Third Party Advisory
https://github.com/krb5/krb5/pull/694Patch, Third Party Advisory
https://github.com/krb5/krb5/pull/694/commits/1de6ca2f2eb1fdbab51f1549a25a6903aefcc196Third Party Advisory
https://github.com/krb5/krb5/pull/694/commits/50fe4074f188c2d4da0c421e96553acea8378db2Third Party Advisory
https://github.com/krb5/krb5/pull/694/commits/b7af544e50a4d8291524f590e20dd44430bf627dThird Party Advisory

Timeline

Published: Jul 26, 2018
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2017-7562?

How severe is CVE-2017-7562?

CVE-2017-7562 has a CVSS score of 6.5/10 (MEDIUM severity). The EPSS model estimates a 3.30% probability of exploitation in the next 30 days.

How do I fix CVE-2017-7562?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2017-7562?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST