CVE-2019-12098: Debian Linux

High severity, CVSS 7.4. EPSS: 2% chance of exploitation in the next 30 days.

In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.

Affected products

• Debian Debian Linux: version 9.0 only
• Fedoraproject Fedora: version 30 only; version 31 only
• Heimdal Project Heimdal: before 7.6.0 (fixed in 7.6.0)
• Opensuse Backports Sle: version 15.0 only
• Opensuse Leap: version 15.0 only; version 15.1 only; version 42.3 only

Published 2019-05-15. Last modified 2026-06-17.