huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2023-23454: kernel: slab-out-of-bounds read vulnerabilities in cbq_classify
Component: kernel
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 4.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-01-01T17:00:00+00:00

An out-of-bounds (OOB) read problem was found in cbq_classify in net/sched/sch_cbq.c in the Linux kernel. This issue may allow a local attacker to cause a denial of service due to type confusion. Non-negative numbers could indicate a TC_ACT_SHOT condition rather than valid classification results.


Affected upstream versions: n/a
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: caa4b35b4317d5147b3ab0fbdc9c075c7d2e9c12
CVE-2023-23455: Kernel: denial of service in atm_tc_enqueue in net/sched/sch_atm.c due to type confusion
Component: Kernel
Severity: Moderate
CWE: CWE-843 (Access of Resource Using Incompatible Type ('Type Confusion'))
CVSS v3: 4.2 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-01-01T17:00:00+00:00

A denial of service flaw was found in atm_tc_enqueue in net/sched/sch_atm.c in the Linux kernel. This issue may allow a local attacker to cause a denial of service due to type confusion. Non-negative numbers could indicate a TC_ACT_SHOT condition rather than valid classification results.


Affected upstream versions: n/a
Fixed upstream versions: v6.2
Upstream repository: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Upstream fix commit: a2965c7be0522eaa18808684b7b82b248515511b
CVE-2023-23931: python-cryptography: memory corruption via immutable objects
Component: python-cryptography
Severity: Moderate
CWE: CWE-754 (Improper Check for Unusual or Exceptional Conditions)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L)
Public date: 2023-02-08T00:00:00+00:00

A vulnerability was found in python-cryptography. In affected versions, `Cipher.update_into` would accept Python objects which implement the buffer protocol but provide only immutable buffers. This issue allows immutable objects (such as `bytes`) to be mutated, thus violating the fundamental rules of Python, resulting in corrupted output.


Affected upstream versions: >=1.8, < 39.0.1
Upstream repository: https://github.com/pyca/cryptography
Upstream fix commit: 94a50a9731f35405f0357fa5f3b177d46a726ab3
CVE-2023-23934: python-werkzeug: cookie prefixed with = can shadow unprefixed cookie
Component: python-werkzeug
Severity: Low
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 2.6 (CVSS:3.1/AV:A/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N)
Public date: 2023-02-14T00:00:00+00:00

A flaw was found in python-werkzeug. Browsers may allow "nameless" cookies like =value instead of key=value. A vulnerable browser may allow a compromised application on an adjacent subdomain to exploit this to set a cookie for another subdomain. If a Werkzeug application is running next to a vulnerable or malicious subdomain that sets such a cookie using a vulnerable browser, the Werkzeug application will see the bad cookie value but the valid cookie key.


Affected upstream versions: < 2.2.3
Fixed upstream versions: 2.2.x
Upstream repository: https://github.com/pallets/werkzeug
Upstream fix commit: cf275f42acad1b5950c50ffe8ef58fe62cdce028
CVE-2023-23936: Node.js: Fetch API did not protect against CRLF injection in host headers
Component: Node.js
Severity: Moderate
CWE: CWE-93 (Improper Neutralization of CRLF Sequences ('CRLF Injection'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
Public date: 2023-02-16T00:00:00+00:00

A flaw was found in the fetch API in Node.js that did not prevent CRLF injection in the 'host' header. This issue could allow HTTP response splitting and HTTP header injection.


Affected upstream versions: >=2.0.0, < 5.19.1
Fixed upstream versions: v5.19.1
Upstream repository: https://github.com/nodejs/undici
Upstream fix commit: a2eff05401358f6595138df963837c24348f2034
CVE-2023-23946: git: git apply: a path outside the working tree can be overwritten with crafted input
Component: git
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-02-14T00:00:00+00:00

A vulnerability was found in Git. This security issue occurs when feeding a crafted input to "git apply." A path outside the working tree can be overwritten by the user running "git apply."

Statement: This vulnerability marked as Moderate severity and it's less likely to be exploitable because it requires a specially crafted malicious patch to be applied via git apply, to overwrite files outside the working tree of the user running git apply. This could lead to some compromise of integrity of resources under certain circumstances, however it does not compromise the whole system or gain additional privileges to execute arbitrary code, or allow remote users to cause a denial of service.

Affected upstream versions: >= 2.39.0, < 2.39.2, >= 2.38.0, < 2.38.4, >= 2.37.0, < 2.37.6, >= 2.36.0, < 2.36.5, >= 2.35.0, < 2.35.7, >= 2.34.0, < 2.34.7, >= 2.33.0, < 2.33.7, >= 2.32.0, < 2.32.6, >= 2.31.0, < 2.31.7, < 2.30.8
Fixed upstream versions: v2.40.0
Upstream repository: https://github.com/git/git
Upstream fix commit: c867e4fa180bec4750e9b54eb10f459030dbebfd
CVE-2023-23947: ArgoCD: Users with any cluster secret update access may update out-of-bounds cluster secrets
Component: ArgoCD
Severity: Important
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2023-02-16T20:51:00+00:00

A flaw was found in ArgoCD. An improper authorization bug may allow an attacker to update at least one cluster secret, enabling them to change any other cluster secret. The attacker must know the URL for the targeted cluster and additionally it should be authenticated within the ArgoCD API server with enough privileges to update at least one cluster. A successful attack may lead to privilege escalations or denial of service.


Affected upstream versions: >= 2.3.0-rc1, < 2.3.17, >= 2.4.0, < 2.4.23, >= 2.5.0, < 2.5.11, >= 2.6.0, < 2.6.2
Fixed upstream versions: v2.7.0
Upstream repository: https://github.com/argoproj/argo-cd
Upstream fix commit: fbb0b99b1ac3361b253052bd30259fa43a520945
CVE-2023-23969: python-django: Potential denial-of-service via Accept-Language headers
Component: python-django
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-01T00:00:00+00:00

A flaw was found in python-django. The parsed values of the Accept-Language headers are cached in order to avoid repetitive parsing. This leads to a potential denial of service vector via excessive memory usage if large header values are sent.


Affected upstream versions: n/a
Fixed upstream versions: stable/4.0.x
Upstream repository: https://github.com/django/django
Upstream fix commit: 4452642f193533e288a52c02efb5bbc766a68f95
CVE-2023-24021: modsecurity: lacking the complete content in FILES_TMP_CONTENT leads to web application firewall bypass
Component: modsecurity
Severity: Moderate
CWE: CWE-402 (Transmission of Private Resources into a New Sphere ('Resource Leak'))
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N)
Public date: 2023-01-20T00:00:00+00:00

A vulnerability was found in ModSecurity. This issue occurs when FILES_TMP_CONTENT lacks complete content, which can lead to a Web Application Firewall bypass.

Statement: Red Hat rates this vulnerability as Moderate impact as a result of how mod_security is configured to be used in Red Hat products. When running with default configurations the affected program will have limited privileges and thus the impact of this flaw will be restricted beyond what the Web Application Firewall is also restricting.

Affected upstream versions: n/a
Fixed upstream versions: v2.9.7
Upstream repository: https://github.com/SpiderLabs/ModSecurity
Upstream fix commit: 4324f0ac59f8225aa44bc5034df60dbeccd1d334
CVE-2023-24805: cups-filters: remote code execution in cups-filters, beh CUPS backend
Component: cups-filters
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2023-05-17T12:00:00+00:00

A vulnerability was found in cups-filters. This security flaw occurs if you use beh to create an accessible network printer, possibly resulting in remote code execution.


Affected upstream versions: <= 2.0rc1
Fixed upstream versions: 2.0.0
Upstream repository: https://github.com/OpenPrinting/cups-filters
Upstream fix commit: 8f274035756c04efeb77eb654e9d4c4447287d65
CVE-2023-24807: Node.js: Regular Expression Denial of Service in Headers fetch API
Component: Node.js
Severity: Low
CWE: CWE-1333 (Inefficient Regular Expression Complexity)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-16T00:00:00+00:00

Undici is an HTTP/1.1 client for Node.js. Prior to version 5.19.1, the `Headers.set()` and `Headers.append()` methods are vulnerable to Regular Expression Denial of Service (ReDoS) attacks when untrusted values are passed into the functions. This is due to the inefficient regular expression used to normalize the values in the `headerValueNormalize()` utility function. This vulnerability was patched in v5.19.1. No known workarounds are available.


Affected upstream versions: < 5.19.1
Fixed upstream versions: v5.19.1
Upstream repository: https://github.com/nodejs/undici
Upstream fix commit: f2324e549943f0b0937b09fb1c0c16cc7c93abdf
CVE-2023-24815: vertx-web: StaticHandler disclosure of classpath resources on Windows when mounted on a wildcard route
Component: vertx-web
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-02-09T00:00:00+00:00

A flaw was found in Vert.X Web. When running the application that serves files using StaticHandler on Windows Operating Systems and Windows File Systems, if the mount point is a wildcard (*), an attacker can exfiltrate any class path resource.


Affected upstream versions: >= 4.0.0, < 4.3.8
Fixed upstream versions: 4.4.0
Upstream repository: https://github.com/vert-x3/vertx-web
Upstream fix commit: 9e3a783b1d1a731055e9049078b1b1494ece9c15
CVE-2023-24824: cmark-gfm: Quadratic complexity bugs may lead to a denial of service
Component: cmark-gfm
Severity: Moderate
CWE: CWE-1286 (Improper Validation of Syntactic Correctness of Input)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-04-01T00:00:00+00:00

A flaw was found in CommonMarker. A polynomial time complexity issue in cmark-gfm may lead to unbounded resource exhaustion and subsequent denial of service.

Statement: This vulnerability can cause a potential denial of service (DoS) issue, but it can be classified as Moderate rather than Important due to a few key factors. First, the vulnerability specifically targets input with large numbers of specific characters (`>` or `-`), which means it is highly context-dependent and unlikely to be triggered by typical use cases. In practice, the majority of markdown documents are unlikely to contain these patterns in excessive quantities. Furthermore, the issue requires input from untrusted or malicious sources to be exploited, as normal, well-formed markdown documents will not trigger the problem. 

While the quadratic time complexity can lead to significant resource exhaustion under certain conditions, it does not inherently enable arbitrary code execution or direct access to sensitive system resources.

Affected upstream versions: < 0.29.0.gfm.10
Fixed upstream versions: 0.29.0.gfm.10
Upstream repository: https://github.com/github/cmark-gfm
Upstream fix commit: 2300c1bd2c8226108885bf019655c4159cf26b59
CVE-2023-2513: kernel: ext4: use-after-free in ext4_xattr_set_entry()
Component: kernel
Severity: Moderate
CWE: CWE-416 (Use After Free)
CVSS v3: 7 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2022-06-14T00:00:00+00:00

A use-after-free vulnerability was found in the Linux kernel's ext4 filesystem in the way it handled the extra inode size for extended attributes. This flaw allows a privileged local user to cause a system crash or other undefined behaviors.

Statement: This flaw has been rated as having Moderate impact because of the preconditions needed to trigger the issue. The vulnerability can be exploited by a regular user, but the filesystem should be mounted with `debug_want_extra_isize`=128 and the user must have write access to the filesystem. It's also important to emphasize that `debug_want_extra_isize` is a debug mount option and should never be used in production.

Affected upstream versions: Fixed in kernel 6.0-rc1
Fixed upstream versions: v6.0
Upstream repository: https://github.com/torvalds/linux
Upstream fix commit: 67d7d8ad99be
CVE-2023-25136: openssh: the functions order_hostkeyalgs() and list_hostkey_types() leads to double-free vulnerability
Component: openssh
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H)
Public date: 2023-02-03T00:00:00+00:00

A flaw was found in the OpenSSH server (sshd), which introduced a double-free vulnerability during options.kex_algorithms handling. An unauthenticated attacker can trigger the double-free in the default configuration.


Affected upstream versions: n/a
Fixed upstream versions: V_9_1_P1
Upstream repository: https://github.com/openssh/openssh-portable
Upstream fix commit: 486c4dc3b83b4b67d663fb0fa62bc24138ec3946
CVE-2023-25153: containerd: OCI image importer memory exhaustion
Component: containerd
Severity: Moderate
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2023-02-15T00:00:00+00:00

A flaw was found in containerd. When importing an OCI image, there was no limit on the number of bytes read for certain files. A maliciously crafted image with a large file, where a limit was not applied could cause a denial of service.


Affected upstream versions: < 1.5.18, >= 1.6.0, < 1.6.18
Fixed upstream versions: v1.6.18
Upstream repository: https://github.com/containerd/containerd
Upstream fix commit: 0c314901076a74a7b797a545d2f462285fdbb8c4
CVE-2023-25155: redis: String matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack
Component: redis
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-28T00:00:00+00:00

A vulnerability was found in Redis. This flaw allows authenticated users issuing specially crafted SRANDMEMBER, ZRANDMEMBER, and HRANDFIELD commands to trigger an integer overflow, resulting in a runtime assertion and termination of the Redis server process.


Affected upstream versions: < 6.0.18, >= 7.0.0, < 7.0.9, >= 6.2.0, < 6.2.11
Fixed upstream versions: 7.0.9
Upstream repository: https://github.com/redis/redis
Upstream fix commit: 2a2a582e7cd99ba3b531336b8bd41df2b566e619
CVE-2023-25165: helm: getHostByName Function Information Disclosure
Component: helm
Severity: Moderate
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N)
Public date: 2023-02-08T00:00:00+00:00

A flaw was found in the helm package. The 'getHostByName' is a Helm template function introduced in Helm v3 and can accept a hostname and return an IP address for that hostname. To get the IP address, the function performs a DNS lookup. The DNS lookup happens when used with 'helm install|upgrade|template' or when the Helm SDK is used to render a chart. Information passed into the chart can be disclosed to the DNS servers used to look up the IP address. For example, a malicious chart could inject getHostByName into a chart to disclose values to a malicious DNS server.


Affected upstream versions: >= 3.0.0, < 3.11.1
Fixed upstream versions: v3.12.0
Upstream repository: https://github.com/helm/helm
Upstream fix commit: 5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2
CVE-2023-25173: containerd: Supplementary groups are not set up properly
Component: containerd
Severity: Moderate
CWE: CWE-842 (Placement of User into Incorrect Group)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L)
Public date: 2023-02-15T00:00:00+00:00

A flaw was found in containerd, where supplementary groups are not set up properly inside a container. If an attacker has direct access to a container and manipulates their supplementary group access, they may be able to use supplementary group access to bypass primary group restrictions in some cases. This issue can allow access to sensitive information or gain the ability to execute code in that container.

Statement: The following products include containerd related code, but do not use the specific Go packages impacted by this CVE, `containerd/cri/server` and `containerd/oci`. This CVE is therefore rated Low for these products:

* OpenShift Container Platform
* OpenShift Service Mesh
* OpenShift API for Data Protection
* Red Hat Advanced Cluster Security
* Red Hat Advanced Cluster Management for Kubernetes

Affected upstream versions: < 1.5.18, >= 1.6.0, < 1.6.18
Fixed upstream versions: v1.6.18
Upstream repository: https://github.com/containerd/containerd
Upstream fix commit: 133f6bb6cd827ce35a5fb279c1ead12b9d21460a
CVE-2023-25193: harfbuzz: allows attackers to trigger O(n^2) growth via consecutive marks
Component: harfbuzz
Severity: Moderate
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-04T00:00:00+00:00

A vulnerability was found HarfBuzz. This flaw allows attackers to trigger O(n^2) growth via consecutive marks during the process of looking back for base glyphs when attaching marks.


Affected upstream versions: n/a
Fixed upstream versions: 7.0.0
Upstream repository: https://github.com/harfbuzz/harfbuzz
Upstream fix commit: 85be877925ddbf34f74a1229f3ca1716bb6170dc
CVE-2023-25563: gssntlmssp: multiple out-of-bounds read when decoding NTLM fields
Component: gssntlmssp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-14T00:00:00+00:00

A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. Multiple out-of-bounds reads occur when decoding NTLM fields and can trigger a denial of service. A 32-bit integer overflow condition can lead to incorrect checks of the consistency of the length of internal buffers. Although most applications will error out before accepting a single input buffer of 4GB in length, this issue can happen. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point if the application allows tokens greater than 4GB in length, leading to a large, up to 65KB, out-of-bounds read, which could cause a denial of service if it reads from unmapped memory.


Affected upstream versions: < 1.2.0
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/gssapi/gss-ntlmssp
Upstream fix commit: 97c62c6167299028d80765080e74d91dfc99efbd
CVE-2023-25564: gssntlmssp: memory corruption when decoding UTF16 strings
Component: gssntlmssp
Severity: Moderate
CWE: CWE-787 (Out-of-bounds Write)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-14T00:00:00+00:00

A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. Memory corruption can be triggered when decoding UTF16 strings. The variable `outlen` was not initialized and could cause writing a zero to an arbitrary place in memory if the `ntlm_str_convert()` fails, which would leave `outlen` uninitialized. This issue can lead to a denial of service if the write hits unmapped memory or randomly corrupts a byte in the application memory space. This vulnerability can trigger an out-of-bounds write, leading to memory corruption, and can be triggered via the main `gss_accept_sec_context` entry point.


Affected upstream versions: < 1.2.0
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/gssapi/gss-ntlmssp
Upstream fix commit: c753000eb31835c0664e528fbc99378ae0cbe950
CVE-2023-25565: gssntlmssp: incorrect free when decoding target information
Component: gssntlmssp
Severity: Moderate
CWE: CWE-590 (Free of Memory not on the Heap)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-14T00:00:00+00:00

A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. An incorrect free when decoding target information can trigger a denial of service. The error condition incorrectly assumes the `cb` and `sh` buffers contain a copy of the data that needs to be freed. However, that is not the case. This vulnerability can be triggered via the main `gss_accept_sec_context` entry point. This issue will likely trigger an assertion failure in `free,` causing a denial of service.


Affected upstream versions: < 1.2.0
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/gssapi/gss-ntlmssp
Upstream fix commit: c16100f60907a2de92bcb676f303b81facee0f64
CVE-2023-25566: gssntlmssp: memory leak when parsing usernames
Component: gssntlmssp
Severity: Moderate
CWE: CWE-401 (Missing Release of Memory after Effective Lifetime)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-14T00:00:00+00:00

A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. A memory leak can be triggered when parsing usernames, triggering a denial of service. The domain portion of a username may be overridden, causing an allocated memory area the size of the domain name to be leaked. This flaw allows an attacker to leak memory via the main `gss_accept_sec_context` entry point, potentially causing a denial of service.


Affected upstream versions: < 1.2.0
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/gssapi/gss-ntlmssp
Upstream fix commit: 8660fb16474054e692a596e9c79670cd4d3954f4
CVE-2023-25567: gssntlmssp: out-of-bounds read when decoding target information
Component: gssntlmssp
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2023-02-14T00:00:00+00:00

A flaw was found in GSS-NTLMSSP, a mechglue plugin for the GSSAPI library that implements NTLM authentication. It has an out-of-bounds read when decoding target information. The length of the `av_pair` is not checked properly for two of the elements, which can trigger an out-of-bounds read via the main `gss_accept_sec_context` entry point and could cause a denial of service if the memory is unmapped.


Affected upstream versions: < 1.2.0
Fixed upstream versions: v1.2.0
Upstream repository: https://github.com/gssapi/gss-ntlmssp
Upstream fix commit: 025fbb756d44ffee8f847db4222ed6aa4bd1fbe4