Out-of-bounds read In github.com/azure/go-ntlmssp
Description
go-ntlmssp is a Go package that provides NTLM/Negotiate authentication over HTTP. Prior to version 0.1.1, a malicious NTLM challenge message can causes an slice out of bounds panic, which can crash any Go process using ntlmssp.Negotiator as an HTTP transport. Version 0.1.1 patches the issue.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 go | 0.1.1 | ||
 debian 12 | - | ||
debian 13 | - | ||
debian 14 | - | ||
debian 11 | - |
Aliases
1. 2. 3. 4. 5. 6. 7.
References
1. 2.