CVE-2020-12658: Critical severity gssproxy vulnerability
DISPUTED gssproxy (aka gss-proxy) before 0.8.3 does not unlock condmutex before pthread exit in gpworkermain() in gpworkers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem."
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-12658?
CVE-2020-12658 is a vulnerability in gssproxy (aka gss-proxy) before version 0.8.3 that allows an attacker to cause a denial of service (DoS) condition.
How severe is CVE-2020-12658?
CVE-2020-12658 is classified as critical with a severity value of 9.8.
Which software versions are affected by CVE-2020-12658?
Gssproxy Project Gssproxy versions up to exclusive 0.8.3 and Debian Debian Linux 9.0 are affected by CVE-2020-12658.
How can I fix CVE-2020-12658?
To fix CVE-2020-12658, update to gssproxy version 0.8.3 or later.
Where can I find more information about CVE-2020-12658?
More information about CVE-2020-12658 can be found at the following references: [Reference 1](https://github.com/gssapi/gssproxy/commit/cb761412e299ef907f22cd7c4146d50c8a792003), [Reference 2](https://github.com/gssapi/gssproxy/compare/v0.8.2...v0.8.3), [Reference 3](https://lists.debian.org/debian-lts-announce/2021/01/msg00004.html).