An issue was discovered in MIT Kerberos 5 (aka krb5) through 1.16. The pre-defined function strlen is getting a NULL string as a parameter value in plugins/kdb/ldap/libkdb_ldap/ldap_principal2.c in the Key Distribution Center (KDC), which allows remote authenticated users to cause a denial of service (NULL pointer dereference) via a modified kadmin client. https://nvd.nist.gov/vuln/detail/CVE-2018-5710
