{"id":"UBUNTU-CVE-2019-12098","details":"In the client side of Heimdal before 7.6.0, failure to verify anonymous PKINIT PA-PKINIT-KX key exchange permits a man-in-the-middle attack. This issue is in krb5_init_creds_step in lib/krb5/init_creds_pw.c.","modified":"2026-04-27T09:11:21.275470Z","published":"2019-05-15T23:29:00Z","related":["USN-5675-1"],"upstream":["CVE-2019-12098"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2019-12098"},{"type":"REPORT","url":"http://www.h5l.org/pipermail/heimdal-announce/2019-May/000009.html"},{"type":"REPORT","url":"https://github.com/heimdal/heimdal/compare/3e58559...bbafe72"},{"type":"REPORT","url":"https://github.com/heimdal/heimdal/releases/tag/heimdal-7.6.0"},{"type":"ADVISORY","url":"https://ubuntu.com/security/notices/USN-5675-1"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2019-12098"}],"affected":[{"package":{"name":"heimdal","ecosystem":"Ubuntu:Pro:14.04:LTS","purl":"pkg:deb/ubuntu/heimdal@1.6~git20131207+dfsg-1ubuntu1.2+esm1?arch=source&distro=trusty/esm"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"}]}],"versions":["1.6~git20120403+dfsg1-3ubuntu0.1","1.6~git20120403+dfsg1-3ubuntu0.2","1.6~git20131207+dfsg-1ubuntu1","1.6~git20131207+dfsg-1ubuntu1.1","1.6~git20131207+dfsg-1ubuntu1.2"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_name":"heimdal-clients","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"heimdal-clients-x","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1","binary_name":"heimdal-docs"},{"binary_name":"heimdal-kcm","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1","binary_name":"heimdal-kdc"},{"binary_name":"heimdal-multidev","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"heimdal-servers","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"heimdal-servers-x","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1","binary_name":"libasn1-8-heimdal"},{"binary_name":"libgssapi3-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libhcrypto4-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1","binary_name":"libhdb9-heimdal"},{"binary_name":"libheimbase1-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libheimntlm0-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libhx509-5-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libkadm5clnt7-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libkadm5srv8-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libkafs0-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libkdc2-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1","binary_name":"libkrb5-26-heimdal"},{"binary_name":"libotp0-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libroken18-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libsl0-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"},{"binary_name":"libwind0-heimdal","binary_version":"1.6~git20131207+dfsg-1ubuntu1.2+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-12098.json"}},{"package":{"name":"heimdal","ecosystem":"Ubuntu:Pro:16.04:LTS","purl":"pkg:deb/ubuntu/heimdal@1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1?arch=source&distro=esm-infra/xenial"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"}]}],"versions":["1.6~rc2+dfsg-10ubuntu1","1.7~git20150920+dfsg-4ubuntu1","1.7~git20150920+dfsg-4ubuntu1.16.04.1"],"ecosystem_specific":{"availability":"Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro","binaries":[{"binary_name":"heimdal-clients","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"heimdal-docs","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"heimdal-kcm","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"heimdal-kdc","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"heimdal-multidev","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"heimdal-servers","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libasn1-8-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libgssapi3-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libhcrypto4-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libhdb9-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libheimbase1-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libheimntlm0-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libhx509-5-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libkadm5clnt7-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libkadm5srv8-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libkafs0-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libkdc2-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libkrb5-26-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libotp0-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libroken18-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libsl0-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"},{"binary_name":"libwind0-heimdal","binary_version":"1.7~git20150920+dfsg-4ubuntu1.16.04.1+esm1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-12098.json"}},{"package":{"name":"heimdal","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/heimdal@7.5.0+dfsg-1ubuntu0.1?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.5.0+dfsg-1ubuntu0.1"}]}],"versions":["7.4.0.dfsg.1-2","7.5.0+dfsg-1"],"ecosystem_specific":{"binaries":[{"binary_name":"heimdal-clients","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"heimdal-docs","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"heimdal-kcm","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"heimdal-kdc","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_version":"7.5.0+dfsg-1ubuntu0.1","binary_name":"heimdal-multidev"},{"binary_name":"heimdal-servers","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libasn1-8-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libgssapi3-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libhcrypto4-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libhdb9-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_version":"7.5.0+dfsg-1ubuntu0.1","binary_name":"libheimbase1-heimdal"},{"binary_name":"libheimntlm0-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libhx509-5-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libkadm5clnt7-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libkadm5srv8-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libkafs0-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libkdc2-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libkrb5-26-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libotp0-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libroken18-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libsl0-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"},{"binary_name":"libwind0-heimdal","binary_version":"7.5.0+dfsg-1ubuntu0.1"}],"availability":"No subscription required"},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2019/UBUNTU-CVE-2019-12098.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},{"type":"Ubuntu","score":"low"}]}