If kdcproxy receives a request for a realm which does not have server addresses defined in its configuration, by default, it will query SRV records in the DNS zone matching the requested realm name. This creates a server-side request forgery vulnerability, since an attacker could send a request for a realm matching a DNS zone where they created SRV records pointing to arbitrary ports and hostnames (which may resolve to loopback or internal IP addresses). This vulnerability can be exploited to probe internal network topology and firewall rules, perform port scanning, and exfiltrate data. Deployments where the "use_dns" setting is explicitly set to false are not affected.

Amazon Linux Fix: The update, python-kdcproxy-0.3.3-1.amzn2.0.1, restricts DNS lookups to only explicitly configured Kerberos realms, preventing unauthorized network scanning. The fix introduces support for wildcard realm patterns to accommodate hierarchical structures, and adds optional parameters ("dns_realm_discovery" and "silence_port_warn") for backward compatibility. See package README for more information.

Action Required:

- If "use_dns" is set to false in your configuration; No action required
- If "use_dns" is true and you already define trusted realms in your configuration; No action required
- If "use_dns" is true and you rely on automatic DNS discovery; You must add your trusted realms to your configuration