CVE-2020-28196: Fedoraproject Fedora

High severity, CVSS 7.5. EPSS: 4.4% chance of exploitation in the next 30 days.

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

Affected products

• Fedoraproject Fedora: version 31 only
• Mit Kerberos 5: before 1.17.2 (fixed in 1.17.2); from 1.18.0, before 1.18.3 (fixed in 1.18.3)
• Netapp Active Iq Unified Manager: affected versions not specified
• Netapp Cloud Backup: affected versions not specified
• Netapp Oncommand Insight: affected versions not specified
• Netapp Oncommand Workflow Automation: affected versions not specified
• Netapp Snapcenter: affected versions not specified
• Oracle Communications Cloud Native Core Policy: version 1.14.0 only
• Oracle Communications Offline Mediation Controller: version 12.0.0.3.0 only
• Oracle Communications Pricing Design Center: version 12.0.0.3.0 only
• Oracle MySQL Server: up to and including 8.0.23

Published 2020-11-06. Last modified 2026-06-17.