4.3Medium

CVE-2022-3437

samba; samba samba Published: 2023-01-12 03:00 (3 years ago)

Description

A heap-based buffer overflow vulnerability was found in Samba within the GSSAPI unwrap_des() and unwrap_des3() routines of Heimdal. The DES and Triple-DES decryption routines in the Heimdal GSSAPI library allow a length-limited write buffer overflow on malloc() allocated memory when presented with a maliciously small packet. This flaw allows a remote user to send specially crafted malicious data to the application, possibly resulting in a denial of service (DoS) attack.

Weakness (CWE): CWE-122

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
samba	samba	fixed 4.15.11
—	samba	Fixed in samba 4.15.11, samba 4.16.6, samba 4.17.2.

References and patches

https://bugzilla.redhat.com/show_bug.cgi?id=2137774
https://www.samba.org/samba/security/CVE-2022-3437.html
https://access.redhat.com/security/cve/CVE-2022-3437
[oss-security] 20230208 [vs] heimdal: CVE-2022-45142: signature validation failure mailing-list
https://security.netapp.com/advisory/ntap-20230216-0008/
GLSA-202309-06 vendor-advisory
GLSA-202310-06 vendor-advisory
[debian-lts-announce] 20240422 [SECURITY] [DLA 3792-1] samba security update mailing-list

CVSS score

4.3Medium

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

EPSS (chance of exploitation in 30 days)

3.86%

higher than 90% of all CVEs

CISA assessment (SSVC)

Exploitation: none
Automatable: no
Technical impact: partial

Timeline

ID reserved2022-10-10
Published2023-01-12 03:00
Reached IP-DB2026-10-24 23:38
Last updated2024-10-28 21:59

Assigned by (CNA): redhat

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Samba

8.1High

CVE-2026-109411 15 days ago

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

Samba Samba; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When …

6.5Medium

CVE-2026-58224 3 months ago

Samba: ctdb fails to do integrity checking of received packets

Red Hat Red Hat Ceph Storage 9.2; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packe…

9.0Critical

CVE-2026-4408 5 months ago

Samba: remote code execution in samr

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controll…

47%EPSS

7.1High

CVE-2026-1933 5 months ago

Samba: missing access check on reparse point operations

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata t…

6.5Medium

CVE-2026-2340 5 months ago

Samba: vfs_worm does not block directory modification

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenti…

8.0High

CVE-2026-3012 5 months ago

Samba: group policy certificate enrollment uses http:// without validation

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verifi…