4.2Orta

CVE-2019-14833

Samba samba Yayım: 2019-11-06 03:00 (7 yıl önce)

Açıklama

A flaw was found in Samba, all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2, in the way it handles a user password change or a new password for a samba user. The Samba Active Directory Domain Controller can be configured to use a custom script to check for password complexity. This configuration can fail to verify password complexity when non-ASCII characters are used in the password, which could lead to weak passwords being set for samba users, making it vulnerable to dictionary attacks.

Zayıflık türü (CWE): CWE-305

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
Samba	samba	all versions starting samba 4.5.0 before samba 4.9.15, samba 4.10.10, samba 4.11.2

Kaynaklar ve yamalar

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14833
https://www.samba.org/samba/security/CVE-2019-14833.html
https://www.synology.com/security/advisory/Synology_SA_19_35
openSUSE-SU-2019:2458 vendor-advisory
FEDORA-2019-57d43f3b58 vendor-advisory
FEDORA-2019-703e299870 vendor-advisory
FEDORA-2019-460ad648e7 vendor-advisory
[debian-lts-announce] 20210529 [SECURITY] [DLA 2668-1] samba security update mailing-list
[debian-lts-announce] 20230914 [SECURITY] [DLA 3563-1] samba security update mailing-list

CVSS puanı

4.2Orta

Kaynak: redhat · CVSS 3.0

Saldırı yolu: Ağ
Karmaşıklık: Yüksek
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekmez
Kapsam: Değişmez
Gizlilik: Düşük
Bütünlük: Düşük
Erişilebilirlik: Yok

CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N

EPSS (30 günde istismar olasılığı)

1.86%

tüm CVE'lerin %79'inden yüksek

Zaman çizelgesi

Numara ayrıldı2019-08-10
Yayımlandı2019-11-06 03:00
IP-DB'ye ulaştı2026-10-24 23:51
Son güncelleme2024-08-05 03:26

Numarayı veren (CNA): redhat

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Samba

8.1Yüksek

CVE-2026-109411 10 gün önce

Samba: access control bypass via vfs_ceph_rgw case-insensitive open

Samba Samba; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

An access control bypass flaw was identified in Samba's vfs_ceph_rgw module in it's openat() function. An authenticated user can bypass access controls to read or overwrite restricted files on shares configured with the experimental vfs_ceph_rgw module. When …

6.5Orta

CVE-2026-58224 2 ay önce

Samba: ctdb fails to do integrity checking of received packets

Red Hat Red Hat Ceph Storage 9.2; Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 6; Red Hat Red Hat Enterprise Linux 7

A flaw was found in Samba's CTDB, the clustered database service used by Samba. Insufficient integrity validation of received CTDB protocol packets allows malformed packets containing invalid field lengths, improperly terminated strings, or inconsistent packe…

9.0Kritik

CVE-2026-4408 5 ay önce

Samba: remote code execution in samr

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support; Red Hat Red Hat Enterprise Linux 8

A flaw was found in Samba. A remote attacker can exploit a misconfiguration in Samba file servers and classic domain controllers that use the "check password script" feature. If this script is configured with the %u substitution character, the client-controll…

2.5%EPSS

7.1Yüksek

CVE-2026-1933 5 ay önce

Samba: missing access check on reparse point operations

Red Hat Red Hat Enterprise Linux 10; Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support; Red Hat Red Hat Enterprise Linux 8; Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

A flaw was found in Samba’s handling of NTFS-style reparse points on shares configured with read only = yes. Due to missing SMB-layer access checks, authenticated users with underlying filesystem write permissions may create or delete reparse point metadata t…

6.5Orta

CVE-2026-2340 5 ay önce

Samba: vfs_worm does not block directory modification

A flaw was found in Samba’s vfs_worm module. The module is intended to provide write-once, read-many (WORM) protections by preventing modification of files after a configurable grace period. Due to insufficient validation during rename operations, an authenti…

8.0Yüksek

CVE-2026-3012 5 ay önce

Samba: group policy certificate enrollment uses http:// without validation

A flaw was found in Samba’s certificate auto-enrollment Group Policy handling. When certificate auto-enrollment is enabled, Samba may retrieve a CA certificate over an unencrypted HTTP connection and install it into the local trust store without proper verifi…