Repository navigation
uplift: go-ntlmssp v0.1.1 for CVE-2026-32952 (#7) - #11
Merged
Merged
Conversation
This was referenced Oct 20, 2026
aspratt
marked this pull request as ready for review
October 20, 2026 04:13
Owner
Author
|
Security second review (Sonnet, different model from the author): APPROVE. The fix is complete (uint64 bounds check in varfield.go), and the regression test fails on the old pin and passes on the new one. Release note: an IdP offering only Basic now fails, because Basic is no longer sent by default. Pre-existing pingntlm issues (hard-coded InsecureSkipVerify, Basic re-auth on redirect) are raised as a separate record. |
Panics on go-ntlmssp v0.0.0-20211209 (slice bounds out of range in varField.ReadFrom, CVE-2026-32952 / GO-2026-5543). Record #7.
Fixes the panic above. v0.1.1 also stops Basic fallback unless AllowBasicAuth is set (kept off, by decision on #7), derives the NTLMv2 domain from the username, and no longer completes Negotiate-only challenges. go mod tidy drops the indirect x/crypto v0.31.0.
Mock IdP offers Basic and NTLM on its 401; asserts the Type 1 / Type 3 sequence, user and domain from DOMAIN\user, no Basic credentials sent, and the returned SAML assertion. Proves go-ntlmssp v0.1.1 on the real path.
v0.1.1 sends user@domain whole in the user field with an empty domain; share the handshake harness between the DOMAIN\user and UPN cases.
aspratt
force-pushed
the
uplift/7-go-ntlmssp
branch
from
October 20, 2026 05:44
85fa93a to
2c07f04
Compare
Owner
Author
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #7 · Upstream: Versent#1524
Classification
type: uplift · nature: security (public CVE) · severity: S2 · provider: pingntlm (also adfs2)
Change
f282e3e regression test (panics on the old pin: slice bounds out of range in varField.ReadFrom); d6ffd0b bump to v0.1.1 (published 2026-04-23). Worker: Vogt WI-1997 (Haiku).
Decisions (maintainer, 2026-10-20)
Evidence
govulncheck: GO-2026-5543 gone (11 → 10 findings; the rest are x/net and jose2go, separate records). pingntlm coverage 60.3% → 72.5%. unit/e2e pass; lint 0; cross-builds ok.
The success-path test has landed:
TestAuthenticateNTLMHandshake(NTLMv2, DOMAIN\user, NTLM preferred over Basic).Known limitation (not a change): a Kerberos-only
Negotiatechallenge returns the original 401, as on the old pin. The live ADFS check is tracked in #27.