Description
GNU Gatekeeper before 3.1 does not limit the number of connections to the status port, which allows remote attackers to cause a denial of service (connection and thread consumption) via a large number of connections.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | gnugk | 4.2-1.3 | openSUSE-SU-2024:10142-1 |
Advisories 1
- openSUSE-SU-2024:10142-1 gnugk-4.2-1.3 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- [oss-security] 20120825 Re: information request on security bug fix in GNU Gatekeeper 3.1 mailing-list
- gatekeeper-unspec-code-exec(77975) vdb-entry
- [oss-security] 20120826 Re: Re: information request on security bug fix in GNU Gatekeeper 3.1 mailing-list
- 55198 vdb-entry
- 50343 third-party-advisory
- http://www.gnugk.org/gnugk-3.1.html
- [oss-security] 20120824 information request on security bug fix in GNU Gatekeeper 3.1 mailing-list
- 84862 vdb-entry
- openSUSE-SU-2016:1856 vendor-advisory