It was reported that in MIT krb5 1.12 and later, an authenticated attacker with permission to modify a principal entry can cause kadmind to dereference a null pointer by supplying a null policy value but including KADM5_POLICY in the mask.
Created krb5 tracking bugs for this issue:
Affects: fedora-all [bug 1302633]
Upstream bug report:
Fixed upstream in krb5 1.14.1:
The upstream bug report also indicates the issue will be fixed in 1.13.4.
This issue has been addressed in the following products:
Red Hat Enterprise Linux 7
Via RHSA-2016:0532 https://rhn.redhat.com/errata/RHSA-2016-0532.html