Threats tagged 'ghsa-97h4-wvj6-xwcp'

Grid Community Toolkit versions before 6.2.20261111 (and globus-gss-assist before 12.9) contain a heap out-of-bounds write vulnerability in the function globus_gss_assist_token_get_fd(). This flaw is triggered by SSLv2 record lengths below 3. Remote unauthenticated attackers can exploit this by sending crafted GSI handshake records to services such as globus-gatekeeper and myproxy, causing heap memory corruption and service crashes.