Red Hat Security Advisory

RHSA-2020:1878

samba security, bug fix, and enhancement update

Released 2020-04-28 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 8) libsmbclient-devel-4.11.2-13.el8, libwbclient-devel-4.11.2-13.el8
Red Hat Enterprise Linux AppStream (v. 8) openchange-2.3-24.el8
Red Hat Enterprise Linux BaseOS (v. 8) ctdb-4.11.2-13.el8, ctdb-tests-4.11.2-13.el8, libsmbclient-4.11.2-13.el8 +18

Fixes 3 records

TI-2019-07518 CVE-2019-10197 · GHSA-v6g6-jxr8-2r44

Path traversal in samba

MEDIUM 45

A flaw was found in samba versions 4.9.x up to 4.9.13, samba 4.10.x up to 4.10.8 and samba 4.11.x up to 4.11.0rc3, when certain parameters were set in the samba configuration file.

CVSS 3.0CRITICAL 9.1 Network No auth No interaction EPSS 0.03182 Published 2019-09-03 Fixed CWE-22

TI-2019-11110 CVE-2019-14907 · GHSA-qw9p-wf2h-j96q

Out-of-bounds read in Red Hat samba

LOW 35

All samba versions 4.9.x before 4.9.18, 4.10.x before 4.10.12 and 4.11.x before 4.11.5 have an issue where if it is set with "log level = 3" (or above) then the string obtained from the client, after a failed character c…

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.03151 Published 2020-01-21 Fixed in 4.11.5, 4.10.12 +1 CWE-125

TI-2019-07538 CVE-2019-10218 · GHSA-mjrv-7h6w-94x4

Path traversal in samba

LOW 35

A flaw was found in the samba client, all samba versions before samba 4.11.2, 4.10.10 and 4.9.15, where a malicious server can supply a pathname to the client with separators.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.03377 Published 2019-11-06 Partial fix CWE-22