The generate_smb_nt_hash function in include/functions.inc in GOsa allows remote attackers to execute arbitrary commands via a crafted pass…

Description

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Advisories 2

• DLA-562-1 gosa - security update Debian Security (DSA / DLA) · Mar 9, 2026
• DLA-408-1 gosa - security update Debian Security (DSA / DLA) · Mar 9, 2026

References

• https://github.com/gosa-project/gosa-core/commit/a67a047cba2cdae8bccb0f0e2bc6d3eb45cfcbc8
• [oss-security] 20160115 Re: Security issues in GOsa mailing-list
• 96388 vdb-entry