Skip to content
OpenAdvisories
High RHSA-2023:3097 5 CVEs

Red Hat Security Advisory: gssntlmssp security update

Published Sep 16, 2024 · Updated Nov 22, 2025

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · RHEL 8 enterprise_linux:8::appstream gssntlmssp 0:1.2.0-1.el8_8
Red Hat · RHEL 8 enterprise_linux:8::appstream gssntlmssp-debuginfo 0:1.2.0-1.el8_8
Red Hat · RHEL 8 enterprise_linux:8::appstream gssntlmssp-debugsource 0:1.2.0-1.el8_8

Vulnerabilities 5

  • High 7.5
    CVE-2023-25565

    GSS-NTLMSSP vulnerable to incorrect free when decoding target information

    GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` …

    gssapi gss-ntlmssp gss-ntlmssp gssntlmssp Debian Ubuntu Azure Linux
  • High 7.5
    CVE-2023-25566

    GSS-NTLMSSP vulnerable to memory leak when parsing usernames

    GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be triggered when parsing usernames which can trigger a denial-of-service. The domain portion of a username may be overridde…

    gssapi gss-ntlmssp gss-ntlmssp gssntlmssp Debian Azure Linux
  • High 7.5
    CVE-2023-25567

    GSS-NTLMSSP vulnerable to out-of-bounds read when decoding target information

    GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can…

    gssapi gss-ntlmssp gssntlmssp gss-ntlmssp Debian Ubuntu Azure Linux
  • Medium 6.5
    CVE-2023-25564

    GSS-NTLMSSP vulnerable to memory corruption when decoding UTF16 strings

    GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was not initialized and could cause writing a zero to an…

    gssapi gss-ntlmssp gssntlmssp gss-ntlmssp Debian Ubuntu Azure Linux
  • Medium 5.9
    CVE-2023-25563

    GSS-NTLMSSP vulnerable to multiple out-of-bounds reads when decoding NTLM fields

    GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorr…

    gssapi gss-ntlmssp gss-ntlmssp gssntlmssp Debian Ubuntu Azure Linux

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2172019
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2172020
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2172021
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2172022
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=2172023
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2023/rhsa-2023_3097.json
  • report
    https://access.redhat.com/security/cve/CVE-2023-25563
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-25563
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-25563
  • article
    https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-jjjx-5qf7-9mgf
  • report
    https://access.redhat.com/security/cve/CVE-2023-25564
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-25564
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-25564
  • article
    https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-r85x-q5px-9xfq
  • report
    https://access.redhat.com/security/cve/CVE-2023-25565
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-25565
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-25565
  • article
    https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfg
  • report
    https://access.redhat.com/security/cve/CVE-2023-25566
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-25566
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-25566
  • article
    https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-mfm4-6g58-jw74
  • report
    https://access.redhat.com/security/cve/CVE-2023-25567
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2023-25567
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2023-25567
  • article
    https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-24pf-6prf-24ch