Red Hat Security Advisory

RHSA-2023:3097

gssntlmssp security update

Released 2023-05-16 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) gssntlmssp-1.2.0-1.el8_8

Fixes 5 records

TI-2023-10870 CVE-2023-25567

GSS-NTLMSSP vulnerable to out-of-bounds read when decoding target information

MEDIUM 41

GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01103 Published 2023-02-14 Fixed in 1.2.0 CWE-125

TI-2023-10869 CVE-2023-25566

GSS-NTLMSSP vulnerable to memory leak when parsing usernames

MEDIUM 41

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01103 Published 2023-02-14 Fixed in 1.2.0 CWE-401

TI-2023-10868 CVE-2023-25565

GSS-NTLMSSP vulnerable to incorrect free when decoding target information

MEDIUM 41

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01103 Published 2023-02-14 Fixed in 1.2.0 CWE-590

TI-2023-10867 CVE-2023-25564

GSS-NTLMSSP vulnerable to memory corruption when decoding UTF16 strings

LOW 39

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.01942 Published 2023-02-14 Fixed in 1.2.0 CWE-787

TI-2023-10866 CVE-2023-25563

GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields

LOW 35

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01091 Published 2023-02-14 Fixed in 1.2.0 CWE-125