PT-2020-13190 · Mit+4 · Gssproxy+4

Published 2020-04-20 · Updated 2024-08-04 · CVE-2020-12658

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions gssproxy versions prior to 0.8.3

Description The issue is related to the gssproxy (aka gss-proxy) not unlocking cond mutex before pthread exit in gp worker main() in gp workers.c. It is noted that the code in question is already on a shutdown path, which may not make a Denial of Service (DoS) a significant concern. However, there is a lack of additional information to indicate why this would be a problem.

Recommendations For versions prior to 0.8.3, update to version 0.8.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the gp worker main() function in gp workers.c until a patch is available.

Fix

DoS

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

ALT-PU-2020-1785

ALT-PU-2020-2172

CVE-2020-12658

DLA-2516-1

MGASA-2021-0081

OESA-2021-1037

OPENSUSE-SU-2021:0531-1

OPENSUSE-SU-2021_0531-1

SUSE-SU-2021:1029-1

SUSE-SU-2021:1030-1

SUSE-SU-2021_1029-1

SUSE-SU-2021_1030-1

Affected Products

Alt Linux

Astra Linux

Debian

Suse

Gssproxy

References · 28

• https://github.com/gssapi/gssproxy/commit/cb761412e299ef907f22cd7c4146d50c8a792003 · Patch
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-12658 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12658 · Security Note
• https://osv.dev/vulnerability/CVE-2020-12658 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2516-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12658 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2021-1037 · Vendor Advisory
• https://debian.org/lts/security/2021/dla-2516 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:0531-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1030-1 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0081 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0081.html · Security Note
• https://cve.org/CVERecord?id=CVE-2020-12658 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-12658 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1029-1 · Vendor Advisory