Amazon Linux 2023 Security Advisory: ALAS2023-2026-1680
Advisory Released Date: 2026-05-14
Advisory Updated Date: 2026-05-14
Severity:
Medium
Issue Overview:
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is a NULL pointer dereference if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, causing the process to terminate in parse_nego_message. (CVE-2026-40355)
In MIT Kerberos 5 (aka krb5) before 1.22.3, there is an integer underflow and resultant out-of-bounds read if an application calls gss_accept_sec_context() on a system with a NegoEx mechanism registered in /etc/gss/mech. An unauthenticated remote attacker can trigger this, possibly causing the process to terminate in parse_message. (CVE-2026-40356)
Affected Packages:
krb5
Issue Correction:
Run dnf update krb5 --releasever 2023.11.20260511 or dnf update --advisory ALAS2023-2026-1680 --releasever 2023.11.20260511 to update your system.
More information on how to update your system can be found on this page: Amazon Linux 2023 documentation
New Packages:
aarch64:
krb5-pkinit-debuginfo-1.21.3-7.amzn2023.0.1.aarch64
krb5-libs-debuginfo-1.21.3-7.amzn2023.0.1.aarch64
krb5-debuginfo-1.21.3-7.amzn2023.0.1.aarch64
krb5-server-debuginfo-1.21.3-7.amzn2023.0.1.aarch64
libkadm5-debuginfo-1.21.3-7.amzn2023.0.1.aarch64
krb5-devel-1.21.3-7.amzn2023.0.1.aarch64
krb5-workstation-debuginfo-1.21.3-7.amzn2023.0.1.aarch64
krb5-server-ldap-debuginfo-1.21.3-7.amzn2023.0.1.aarch64
krb5-server-1.21.3-7.amzn2023.0.1.aarch64
libkadm5-1.21.3-7.amzn2023.0.1.aarch64
krb5-server-ldap-1.21.3-7.amzn2023.0.1.aarch64
krb5-pkinit-1.21.3-7.amzn2023.0.1.aarch64
krb5-libs-1.21.3-7.amzn2023.0.1.aarch64
krb5-debugsource-1.21.3-7.amzn2023.0.1.aarch64
krb5-workstation-1.21.3-7.amzn2023.0.1.aarch64
src:
krb5-1.21.3-7.amzn2023.0.1.src
x86_64:
krb5-server-ldap-debuginfo-1.21.3-7.amzn2023.0.1.x86_64
krb5-libs-debuginfo-1.21.3-7.amzn2023.0.1.x86_64
krb5-pkinit-debuginfo-1.21.3-7.amzn2023.0.1.x86_64
libkadm5-debuginfo-1.21.3-7.amzn2023.0.1.x86_64
krb5-debugsource-1.21.3-7.amzn2023.0.1.x86_64
krb5-workstation-debuginfo-1.21.3-7.amzn2023.0.1.x86_64
krb5-devel-1.21.3-7.amzn2023.0.1.x86_64
krb5-pkinit-1.21.3-7.amzn2023.0.1.x86_64
krb5-debuginfo-1.21.3-7.amzn2023.0.1.x86_64
libkadm5-1.21.3-7.amzn2023.0.1.x86_64
krb5-server-1.21.3-7.amzn2023.0.1.x86_64
krb5-server-debuginfo-1.21.3-7.amzn2023.0.1.x86_64
krb5-server-ldap-1.21.3-7.amzn2023.0.1.x86_64
krb5-libs-1.21.3-7.amzn2023.0.1.x86_64
krb5-workstation-1.21.3-7.amzn2023.0.1.x86_64