7.5

CVE-2020-28196: fedoraproject fedora Uncontrolled Recursion

CVSS: 7.5v3.1HighModified
AliasesALPINE-CVE-2020-28196MGASA-2021-0022SUSE-SU-2020:3375-1
Published 06-11-2020Last modified 14-10-2026
Open JSON

Vulnerability summary

CVE-2020-28196 is a high (CVSS 7.5) Uncontrolled Recursion vulnerability in fedoraproject fedora. EPSS estimates a 4.42% chance of exploitation in the next 30 days, higher than 91.2% of scored vulnerabilities.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
4.42%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 1
OPENSUSE-SU-2024:11549-1RHSA-2021:2239

Timeline

  1. 06-11-2020
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

CVSS metrics

7 scores · 6 sources · 2 versions

EPSS trend

Probability

4.42%

Chance of exploitation in the next 30 days

Percentile

91%

Versus all other CVEs

30-day change

0.00 pp

From 4.42% on 21-09-2026

21-09-202621-10-2026
EPSS score
4.42%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse26 products
  • krb5&distro=HPE Helion OpenStack 8< 1.12.5-40.40.2
  • krb5&distro=SUSE Enterprise Storage 5< 1.12.5-40.40.2
  • krb5&distro=SUSE Linux Enterprise High Performance Computing 15-ESPOS< 1.15.2-6.12.2
  • krb5&distro=SUSE Linux Enterprise High Performance Computing 15-LTSS< 1.15.2-6.12.2
  • krb5&distro=SUSE Linux Enterprise Module for Basesystem 15 SP1< 1.16.3-3.15.1
Redhat17 products
  • krb5< 0:1.18.2-8.el8
  • krb5-debuginfo< 0:1.18.2-8.el8
  • krb5-debugsource< 0:1.18.2-8.el8
  • krb5-devel< 0:1.18.2-8.el8
  • krb5-devel-debuginfo< 0:1.18.2-8.el8
Netapp5 products
Opensuse4 products
  • krb5-mini&distro=openSUSE Leap 15.1< 1.16.3-lp151.2.15.1
  • krb5-mini&distro=openSUSE Leap 15.2< 1.16.3-lp152.5.13.1
  • krb5&distro=openSUSE Leap 15.1< 1.16.3-lp151.2.15.1
  • krb5&distro=openSUSE Leap 15.2< 1.16.3-lp152.5.13.1
Oracle4 products
Alpine1 product
  • krb5< 1.17.2-r0 | < 1.18.3-r0 | < 1.15.5-r1
Debian1 product
  • krb5< 1.17-3+deb10u1 | < 1.15-1+deb9u2 | < 1.18.3-1
Fedoraproject1 product
Mageia1 product
  • krb5< 1.17-2.1.mga7
Mit1 product
Ubuntu1 product
  • krb5< 1.12+dfsg-2ubuntu5.4+esm2 | < 1.13.2+dfsg-5ubuntu2.2 | < 1.16-2ubuntu0.2 | < 1.17-6ubuntu4.1

11 vendors · 62 products

References

42 links
Show all 42 references