{"id":"CVE-2020-1703","state":"REJECTED","title":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Red Hat P","description":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Red Hat Product Security does not consider this as a security flaw. Password changes aren't expected to invalidate existing sessions. Though this is how Kerberos behaves: incrementing kvno will not invalidate any existing service tickets. This is not a concern because the lifetime on service tickets should be set appropriately (initially only a global, now also more finely configurable with the kdcpolicy plugin). This belief is reinforced by our use of mod_session: existing sessions there aren't terminated, but instead wait for expiration","publishedAt":"2020-06-03T13:49:08.000Z","updatedAt":"2020-06-03T13:50:09.000Z","severity":null,"assigner":"redhat","products":[],"affected":[],"references":[],"weaknesses":[],"ingestedAt":"2026-10-29T19:46:49.649Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2020/1xxx/CVE-2020-1703.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.0","cveMetadata":{"cveId":"CVE-2020-1703","state":"REJECTED","datePublished":"2020-06-03T13:49:08.000Z","dateUpdated":"2020-06-03T13:50:09.000Z","assignerShortName":"redhat","assignerOrgId":"53f830b8-0a3f-465b-8143-3b8a9948e749","dateRejected":"2020-06-03T13:49:08.000Z","dateReserved":"2019-11-27T00:00:00.000Z"},"containers":{"cna":{"rejectedReasons":[{"lang":"en","value":"DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: Red Hat Product Security does not consider this as a security flaw. Password changes aren't expected to invalidate existing sessions. Though this is how Kerberos behaves: incrementing kvno will not invalidate any existing service tickets. This is not a concern because the lifetime on service tickets should be set appropriately (initially only a global, now also more finely configurable with the kdcpolicy plugin). This belief is reinforced by our use of mod_session: existing sessions there aren't terminated, but instead wait for expiration"}],"providerMetadata":{"shortName":"redhat","dateUpdated":"2020-06-03T13:50:09.000Z","orgId":"53f830b8-0a3f-465b-8143-3b8a9948e749"}}}}}