gss-ntlmssp - Debian Package Tracker

general

source: gss-ntlmssp (main)
version: 1.2.0-1
maintainer: Timo Aaltonen (DMD)
arch: any
std-ver: 4.6.0
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 0.7.0-4
oldstable: 0.7.0-4
stable: 1.2.0-1
testing: 1.2.0-1
unstable: 1.2.0-1

versioned links

0.7.0-4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

gss-ntlmssp
gss-ntlmssp-dev

action needed

Depends on packages which need a new maintainer normal

The packages that gss-ntlmssp depends on which need a new maintainer are:

docbook-xml (#802368)
- Build-Depends: docbook-xml
docbook-xsl (#802370)
- Build-Depends: docbook-xsl

Created: 2023-09-01 Last update: 2023-09-23 02:14

version in VCS is newer than in repository, is it time to upload? normal

vcswatch reports that this package seems to have a new changelog entry (version 1.2.0-2, distribution UNRELEASED) and new commits in its VCS. You should consider whether it's time to make an upload.

Here are the relevant commit messages:

commit 443321e1062716dd0115b9fa79a00f9ac2e6c502
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Feb 16 14:16:41 2023 +0000

    Update standards version to 4.6.2, no changes needed.
    
    Changes-By: lintian-brush
    Fixes: lintian: out-of-date-standards-version
    See-also: https://lintian.debian.org/tags/out-of-date-standards-version.html

commit efd121f8f4dc3edc353ff0b0096993c6f05a788d
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Feb 16 14:16:40 2023 +0000

    Set upstream metadata fields: Bug-Database, Bug-Submit, Repository-Browse.
    
    Changes-By: lintian-brush
    Fixes: lintian: upstream-metadata-file-is-missing
    See-also: https://lintian.debian.org/tags/upstream-metadata-file-is-missing.html
    Fixes: lintian: upstream-metadata-missing-bug-tracking
    See-also: https://lintian.debian.org/tags/upstream-metadata-missing-bug-tracking.html

commit 072d81a503b71a1fb7d3d0cfb6fe38f1ce4db1be
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Feb 16 14:16:34 2023 +0000

    Use secure copyright file specification URI.
    
    Changes-By: lintian-brush
    Fixes: lintian: insecure-copyright-format-uri
    See-also: https://lintian.debian.org/tags/insecure-copyright-format-uri.html

commit 0d9657179d54ef16a47d9db1250f2247331a460d
Author: Debian Janitor <janitor@jelmer.uk>
Date:   Thu Feb 16 14:16:33 2023 +0000

    Trim trailing whitespace.
    
    Changes-By: lintian-brush
    Fixes: lintian: trailing-whitespace
    See-also: https://lintian.debian.org/tags/trailing-whitespace.html

Created: 2023-08-17 Last update: 2023-09-20 07:02

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2023-02-18 Last update: 2023-02-18 17:06

3 low-priority security issues in bullseye low

There are 3 open security issues in bullseye.

3 issues left for the package maintainer to handle:

CVE-2023-25563: (needs triaging) GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, multiple out-of-bounds reads when decoding NTLM fields can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of consistency of length of internal buffers. Although most applications will error out before accepting a singe input buffer of 4GB in length this could theoretically happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length. This can lead to a large, up to 65KB, out-of-bounds read which could cause a denial-of-service if it reads from unmapped memory. Version 1.2.0 contains a patch for the out-of-bounds reads.
CVE-2023-25565: (needs triaging) GSS-NTLMSSP is a mechglue plugin for the GSSAPI library that implements NTLM authentication. Prior to version 1.2.0, an incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This will likely trigger an assertion failure in `free`, causing a denial-of-service. This issue is fixed in version 1.2.0.
CVE-2023-25567: (needs triaging) GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication, has an out-of-bounds read when decoding target information prior to version 1.2.0. The length of the `av_pair` is not checked properly for two of the elements which can trigger an out-of-bound read. The out-of-bounds read can be triggered via the main `gss_accept_sec_context` entry point and could cause a denial-of-service if the memory is unmapped. The issue is fixed in version 1.2.0.

You can find information about how to handle these issues in the security team's documentation.

Created: 2023-02-14 Last update: 2023-06-11 06:30

debian/patches: 1 patch to forward upstream low

Among the 1 debian patch available in version 1.2.0-1 of the package, we noticed the following issues:

1 patch where the metadata indicates that the patch has not yet been forwarded upstream. You should either forward the patch upstream or update the metadata to document its real status.

Created: 2023-02-26 Last update: 2023-02-26 15:54

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.6.2 instead of 4.6.0).

Created: 2022-05-11 Last update: 2023-02-16 23:07

news

[rss feed]

[2023-02-27] gss-ntlmssp 1.2.0-1 MIGRATED to testing (Debian testing watch)
[2023-02-16] Accepted gss-ntlmssp 1.2.0-1 (source) into unstable (Timo Aaltonen)
[2022-03-20] gss-ntlmssp 1.0.0-1 MIGRATED to testing (Debian testing watch)
[2022-03-15] Accepted gss-ntlmssp 1.0.0-1 (source) into unstable (Timo Aaltonen)
[2017-09-26] gss-ntlmssp 0.7.0-4 MIGRATED to testing (Debian testing watch)
[2017-09-21] Accepted gss-ntlmssp 0.7.0-4 (source) into unstable (Timo Aaltonen)
[2016-11-29] gss-ntlmssp 0.7.0-3 MIGRATED to testing (Debian testing watch)
[2016-11-23] Accepted gss-ntlmssp 0.7.0-3 (source) into unstable (Timo Aaltonen)
[2016-11-22] Accepted gss-ntlmssp 0.7.0-2 (source) into unstable (Timo Aaltonen)
[2016-09-19] Accepted gss-ntlmssp 0.7.0-1 (source) into unstable (Timo Aaltonen)
[2015-09-14] gss-ntlmssp 0.6.0-1 MIGRATED to testing (Britney)
[2015-09-04] Accepted gss-ntlmssp 0.6.0-1 (source amd64) into unstable, unstable (Timo Aaltonen)

bugs [bug history graph]

all: 2
RC: 0
I&N: 2
M&W: 0
F&P: 0
patch: 0

links

homepage
lintian (0, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
edit tags
other distros
security tracker
screenshots
l10n (-, 100)
debian patches

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.2.0-1
1 bug