CVE-2026-56968

Опубликовано: 23 июн. 2026

Источник: nvd

CVSS3: 3.7

CVSS3: 5.3

EPSS Низкий

Описание

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

Ссылки

https://ftp.gnu.org/gnu/gsasl/
Product
https://lists.debian.org/debian-security-announce/2026/msg00259.html
Mailing List
https://lists.gnu.org/archive/html/help-gsasl/2026-06/msg00000.html
Exploit
Mailing List
Vendor Advisory
https://www.gnu.org/software/gsasl/
Product
https://lists.debian.org/debian-lts-announce/2026/07/msg00049.html

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:gnu:sasl:*:*:*:*:*:*:*:*

Версия до 2.2.4 (исключая)

Конфигурация 2

cpe:2.3:o:debian:debian_linux:13.0:*:*:*:*:*:*:*

EPSS

Процентиль: 21%

0.00286

Низкий

3.7 Low

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-839

CWE-908

Связанные уязвимости

CVE-2026-56968

CVSS3: 3.7

ubuntu

около 1 месяца назад

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

CVE-2026-56968

CVSS3: 3.7

debian

около 1 месяца назад

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsas ...

openSUSE-SU-2026:21303-1

suse-cvrf

26 дней назад

Security update for gsasl

GHSA-2qgp-6c6g-cmwv

CVSS3: 3.7

github

около 1 месяца назад

GNU SASL before 2.2.4 lacks sanitization of a short challenge in _gsasl_ntlm_client_step in the NTLM client, which could result in memory disclosure via a crafted server.

EPSS

Процентиль: 21%

0.00286

Низкий

3.7 Low

CVSS3

5.3 Medium

CVSS3

Дефекты

CWE-839

CWE-908