In GNU SASL before 2.2.3, DIGEST-MD5 has a NULL pointer dereference affecting both clients and servers, via a known token with no accompanying = character. This occurs in lib/digest-md5/getsubopt.c.
| Vendor | Product | Versions |
|---|---|---|
| gnu | gnu sasl | 0 |
Updated affected versions to include 2.2.2, changed severity to MEDIUM, and noted that there is no available exploit.
Initial creation
