gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.

According to the version of the gssproxy package installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** gssproxy (aka gss-proxy) before 0.8.3     does not unlock cond_mutex before pthread exit in     gp_worker_main() in gp_workers.c. NOTE: An upstream     comment states 'We are already on a shutdown path when     running the code in question, so a DoS there doesn't     make any sense, and there has been no additional     information provided us (as upstream) to indicate why     this would be a problem.'(CVE-2020-12658)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gssproxy package installed, the EulerOS installation on the remote host is affected by the following vulnerability :

  - gssproxy (aka gss-proxy) before 0.8.3 does not unlock     cond_mutex before pthread exit in gp_worker_main() in     gp_workers.c. NOTE: An upstream comment states 'We are     already on a shutdown path when running the code in     question, so a DoS there doesn't make any sense, and     there has been no additional information provided us     (as upstream) to indicate why this would be a     problem.'(CVE-2020-12658)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for gssproxy fixes the following issues :

  - CVE-2020-12658: Fixed an issue where gssproxy was not     unlocking cond_mutex before pthread exit in     gp_worker_main() (bsc#1180515).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

This update for gssproxy fixes the following issues :

CVE-2020-12658: Fixed an issue where gssproxy was not unlocking cond_mutex before pthread exit in gp_worker_main() (bsc#1180515).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the gssproxy package installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - ** DISPUTED ** gssproxy (aka gss-proxy) before 0.8.3     does not unlock cond_mutex before pthread exit in     gp_worker_main() in gp_workers.c. NOTE: An upstream     comment states 'We are already on a shutdown path when     running the code in question, so a DoS there doesn't     make any sense, and there has been no additional     information provided us (as upstream) to indicate why     this would be a problem.'(CVE-2020-12658)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

It was discovered that there was an issue in the gssproxy privilege separation caused by gssproxy not unlocking cond_mutex prior to calling pthread_exit.

For Debian 9 'Stretch', this problem has been fixed in version 0.5.1-2+deb9u1.

We recommend that you upgrade your gssproxy packages.

For the detailed security status of gssproxy please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/gssproxy

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
151381	EulerOS Virtualization 3.0.2.2 : gssproxy (EulerOS-SA-2021-2137)	Nessus	Huawei Local Security Checks	critical
149115	EulerOS 2.0 SP3 : gssproxy (EulerOS-SA-2021-1795)	Nessus	Huawei Local Security Checks	critical
148431	openSUSE Security Update : gssproxy (openSUSE-2021-531)	Nessus	SuSE Local Security Checks	critical
148362	SUSE SLES12 Security Update : gssproxy (SUSE-SU-2021:1030-1)	Nessus	SuSE Local Security Checks	critical
148361	SUSE SLED15 / SLES15 Security Update : gssproxy (SUSE-SU-2021:1029-1)	Nessus	SuSE Local Security Checks	critical
148059	EulerOS 2.0 SP5 : gssproxy (EulerOS-SA-2021-1679)	Nessus	Huawei Local Security Checks	critical
147584	EulerOS Virtualization 3.0.6.6 : gssproxy (EulerOS-SA-2021-1481)	Nessus	Huawei Local Security Checks	critical
147533	EulerOS Virtualization 3.0.2.6 : gssproxy (EulerOS-SA-2021-1413)	Nessus	Huawei Local Security Checks	critical
147423	EulerOS Virtualization for ARM 64 3.0.2.0 : gssproxy (EulerOS-SA-2021-1407)	Nessus	Huawei Local Security Checks	critical
146650	EulerOS 2.0 SP2 : gssproxy (EulerOS-SA-2021-1304)	Nessus	Huawei Local Security Checks	critical
145712	EulerOS 2.0 SP8 : gssproxy (EulerOS-SA-2021-1145)	Nessus	Huawei Local Security Checks	critical
144735	Debian DLA-2516-1 : gssproxy security update	Nessus	Debian Local Security Checks	critical

Detections

Analytics

CVE-2020-12658

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical