PYSEC-2017-66.yaml

id: PYSEC-2017-66
details: The checkPassword function in python-kerberos does not authenticate the KDC
  it attempts to communicate with, which allows remote attackers to cause a denial
  of service (bad response), or have other unspecified impact by performing a man-in-the-middle
  attack.
affected:
- package:
    name: pykerberos
    ecosystem: PyPI
    purl: pkg:pypi/pykerberos
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 1.1.6
  versions:
  - 1.1.3
  - 1.1.4
  - 1.1.5
references:
- type: WEB
  url: https://pypi.python.org/pypi/kerberos
- type: REPORT
  url: https://github.com/apple/ccs-pykerberos/issues/31
- type: REPORT
  url: https://bugzilla.redhat.com/show_bug.cgi?id=1223802
- type: WEB
  url: http://www.securityfocus.com/bid/74760
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2015/05/21/3
aliases:
- CVE-2015-3206
modified: "2021-07-25T23:34:51.016854Z"
published: "2017-08-25T18:29:00Z"