Every CVE Search/ Get API key

CVE-2020-12658

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in...

9.8 CriticalFix availableDisputed

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

1.77%Up 0.7 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.

Record
CVE-2020-12658
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness
CWE-667
Updated
2026-11-02
CVE List No score

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.

Record
CVE-2020-12658
Updated
2026-11-02
EUVDEUVD-2020-4957 No score

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.

Record
EUVD-2020-4957
Updated
2026-11-03
GitHub AdvisoriesGHSA-p2qg-cv6r-5429 9.8

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in...

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c.

Record
GHSA-p2qg-cv6r-5429
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-667
Updated
2026-11-02
OSV 9.8

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.

Record
CVE-2020-12658
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVDEBIAN-CVE-2020-12658 9.8

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem.

Record
DEBIAN-CVE-2020-12658
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 5 moreShow less
OSVOESA-2021-1037 9.8

gssproxy security update

This is a proxy for GSSAPI which deals with credential handling.\r\n\r\n Security Fix(es):\r\n\r\n ** DISPUTED ** gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c. NOTE: An upstream comment states "We are already on a shutdown path when running the code in question, so a DoS there doesn't make any sense, and there has been no additional information provided us (as upstream) to indicate why this would be a problem."(CVE-2020-12658)\r\n\r\n

Record
OESA-2021-1037
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2021-0081 No score

Updated gssproxy package fixes a security vulnerability

gssproxy (aka gss-proxy) before 0.8.3 does not unlock cond_mutex before pthread exit in gp_worker_main() in gp_workers.c (CVE-2020-12658).

Record
MGASA-2021-0081
Updated
2026-11-02
OSVopenSUSE-SU-2021:0531-1 No score

Security update for gssproxy

This update for gssproxy fixes the following issues:

  • CVE-2020-12658: Fixed an issue where gssproxy was not unlocking cond_mutex before pthread exit in gp_worker_main() (bsc#1180515).

This update was imported from the SUSE:SLE-15-SP1:Update update project.

Record
openSUSE-SU-2021:0531-1
Updated
2026-11-02
OSVSUSE-SU-2021:1029-1 No score

Security update for gssproxy

This update for gssproxy fixes the following issues:

  • CVE-2020-12658: Fixed an issue where gssproxy was not unlocking cond_mutex before pthread exit in gp_worker_main() (bsc#1180515).
Record
SUSE-SU-2021:1029-1
Updated
2026-11-02
OSVSUSE-SU-2021:1030-1 No score

Security update for gssproxy

This update for gssproxy fixes the following issues:

  • CVE-2020-12658: Fixed an issue where gssproxy was not unlocking cond_mutex before pthread exit in gp_worker_main() (bsc#1180515).
Record
SUSE-SU-2021:1030-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
gssproxy
Debian:12
 before 0.8.4-1
0.8.4-1
gssproxy
Debian:13
 before 0.8.4-1
0.8.4-1
gssproxy
Debian:14
 before 0.8.4-1
0.8.4-1
gssproxy
Debian:9
 before 0.5.1-2+deb9u1, plus listed versions
0.5.1-2
0.5.1-2+deb9u1
gssproxy
Mageia:7
 before 0.8.2-2.1.mga7
0.8.2-2.1.mga7
gssproxy
openEuler:20.03-LTS
 before 0.8.3-1.oe1
0.8.3-1.oe1
gssproxy
SUSE:Linux Enterprise Module for Basesystem 15 SP2
 before 0.8.2-3.6.1
0.8.2-3.6.1
gssproxy
SUSE:Linux Enterprise Server 12 SP5
 before 0.8.2-4.5.1
0.8.2-4.5.1
gssproxy
SUSE:Linux Enterprise Server for SAP Applications 12 SP5
 before 0.8.2-4.5.1
0.8.2-4.5.1
gssproxy
openSUSE:Leap 15.2
 before 0.8.2-lp152.2.3.1
0.8.2-lp152.2.3.1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-12658 is a critical vulnerability (CVSS 9.8) in Gssproxy Project Gssproxy, published December 31, 2020. Its validity is disputed. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in gssproxy 0.8.4-1.

References

Show 10 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open