CVE-2019-12098

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

• CWE-295

• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.htmlMailing List, Third Party Advisory
• http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.htmlPatch, Vendor Advisory
• https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cfPatch, Third Party Advisory
• https://github.com/heimdal/heimdal/compare/3e58559...bbafe72Patch, Third Party Advisory
• https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIXEDVVMPD6ZAJSMI2EZ7FNEIVNWE5PD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLXXIF4LOQEAEDAF4UGP2AO6WDNTDFUB/
• https://seclists.org/bugtraq/2019/Jun/1Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4455Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00002.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00003.htmlMailing List, Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-08/msg00026.htmlMailing List, Third Party Advisory
• http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.htmlPatch, Vendor Advisory
• https://github.com/heimdal/heimdal/commit/2f7f3d9960aa6ea21358bdf3687cee5149aa35cfPatch, Third Party Advisory
• https://github.com/heimdal/heimdal/compare/3e58559...bbafe72Patch, Third Party Advisory
• https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GIXEDVVMPD6ZAJSMI2EZ7FNEIVNWE5PD/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SLXXIF4LOQEAEDAF4UGP2AO6WDNTDFUB/
• https://seclists.org/bugtraq/2019/Jun/1Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4455Third Party Advisory

Published

May 15, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-12087Samsung S9+, S10, and XCover 4 P(9.0) devices can become tem…
• CVE-2019-1209An information disclosure vulnerability exists in Lync 2013,…6.5
• CVE-2019-12091The Netskope client service, v57 before 57.2.0.219 and v60 b…7.8
• CVE-2019-12094Horde Groupware Webmail Edition through 5.2.22 allows XSS vi…6.1
• CVE-2019-12095Horde Trean, as used in Horde Groupware Webmail Edition thro…8.8
• CVE-2019-12097Telerik Fiddler v5.0.20182.28034 doesn't verify the hash of …
• CVE-2019-12099In PHP-Fusion 9.03.00, edit_profile.php allows remote authen…
• CVE-2019-1210Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2019-12101coap_decode_option in coap.c in LibNyoci 0.07.00rc1 mishandl…
• CVE-2019-12102Kentico 11 through 12 lets attackers upload and explore file…
• CVE-2019-12103The web-based configuration interface of the TP-Link M7350 V…
• CVE-2019-12104The web-based configuration interface of the TP-Link M7350 V…