Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

The KDC decodes requests using the libkrb5 ASN.1 DER decoder, but obtains pointers to subsets of the encoding (such as the KDC-REQ-BODY) via its own fetch_asn1_field().  This utility function does not consider the input length, assumes the tag identifier is a single byte, and supports indefinite length encoding.  The libkrb5 decoder accepts multi-byte tag identifiers and does not enforce minimality of tag identifier encoding.  A request packet crafted using a non-minimal tag identifier can pass through the libkrb5 decoder, but fool fetch_asn1_field() into indefinite length processing, which may send it reading beyond the bounds of the packet.