Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv

8.6 CVSS

Vulnerability Description

If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-59088

Check My Exposure

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

Red Hat would like to thank Arad Inbar for reporting this issue.

References

More from latchset

View All →

CVE-2025-59089

Python-kdcproxy: remote dos via unbounded tcp upstream buffering

Medium 5.9

CVE-2024-28102

JWCrypto vulnerable to JWT bomb Attack in `deserialize` function

Medium 6.8

CVE-2016-6298

The _Rsa15 class in the RSA 1.5 algorithm implementation in...

Medium 5.3

Affected Vendor

latchset

View all reports →

Affected Software

kdcproxy, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 7 Extended Lifecycle Support, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.2 Advanced Update Support, Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Telecommunications Update Service, Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Extended Update Support, Red Hat Enterprise Linux 9.6 Extended Update Support

Vulnerable Versions:

0, 0:1.0.0-19.el10_1, 0:1.0.0-19.el10_0, 0:0.3.2-3.el7_9.3, 8100020251103113748.143e9e98, 8100020251028161822.823393f5, 8020020251106022345.792f4060, 8040020251103205102.5b01ab7e, 8060020251030180424.ada582f1, 8080020251029082621.b0a6ceea, 0:1.0.0-9.el9_7, 0:1.0.0-7.el9_0.1, 0:1.0.0-7.el9_2.1, 0:1.0.0-7.el9_4.1, 0:1.0.0-9.el9_6