CVE-2023-25565

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-590 CWE-763

Affected software

Vendor	Product	Versions
gssapi	gss-ntlmssp	< 1.2.0

References

https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64Patch, Third Party Advisory
https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0Third Party Advisory
https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfgThird Party Advisory
https://github.com/gssapi/gss-ntlmssp/commit/c16100f60907a2de92bcb676f303b81facee0f64Patch, Third Party Advisory
https://github.com/gssapi/gss-ntlmssp/releases/tag/v1.2.0Third Party Advisory
https://github.com/gssapi/gss-ntlmssp/security/advisories/GHSA-7q7f-wqcg-mvfgThird Party Advisory

Timeline

Published: Feb 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-255667.5GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, a memory leak can be tr CVE-2023-255677.5GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target in CVE-2023-255687.5Boxo, formerly known as go-libipfs, is a library for building IPFS applications and implementations. In versions 0.4.0 and 0.5.0, if an atta CVE-2023-255695.7Apollo is a configuration management system. Prior to version 2.1.0, a low-privileged user can create a special web page. If an authenticate CVE-2023-25574.3The WPCS – WordPress Currency Switcher Professional plugin for WordPress is vulnerable to unauthorized modification of data due to a missing CVE-2023-255707.5Apollo is a configuration management system. Prior to version 2.1.0, there are potential security issues if users expose apollo-configservic CVE-2023-255715.4Backstage is an open platform for building developer portals. `@backstage/catalog-model` prior to version 1.2.0, `@backstage/core-components CVE-2023-255725.4react-admin is a frontend framework for building browser applications on top of REST/GraphQL APIs. react-admin prior to versions 3.19.12 and CVE-2023-255737.5metersphere is an open source continuous testing platform. In affected versions an improper access control vulnerability exists in `/api/jme CVE-2023-255749.8`jupyterhub-ltiauthenticator` is a JupyterHub authenticator for learning tools interoperability (LTI). LTI13Authenticator that was introduce CVE-2023-255756.5API Platform Core is the server component of API Platform: hypermedia and GraphQL APIs. Resource properties secured with the `security` opti CVE-2023-255767.5@fastify/multipart is a Fastify plugin to parse the multipart content-type. Prior to versions 7.4.1 and 6.0.1, @fastify/multipart may experi