CVE-2023-25565

Name of the Vulnerable Software and Affected Versions GSS-NTLMSSP versions prior to 1.2.0

Description The issue is related to an incorrect free when decoding target information, which can trigger a denial of service. This occurs because the error condition incorrectly assumes the cb and sh buffers contain a copy of the data that needs to be freed. The vulnerability can be triggered via the main gss accept sec context entry point, likely causing an assertion failure in free.

Recommendations For versions prior to 1.2.0, update to version 1.2.0 to resolve the issue. As a temporary workaround, consider restricting the use of the gss accept sec context entry point until the update is applied.