Red Hat Security Advisory

RHSA-2023:6667

samba security, bug fix, and enhancement update

Released 2023-11-07 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder (v. 9) libnetapi-devel-4.18.6-100.el9, libsmbclient-devel-4.18.6-100.el9, libwbclient-devel-4.18.6-100.el9 +6
Red Hat Enterprise Linux AppStream (v. 9) samba-client-4.18.6-100.el9, samba-krb5-printing-4.18.6-100.el9, samba-vfs-iouring-4.18.6-100.el9 +3
Red Hat Enterprise Linux BaseOS (v. 9) libnetapi-4.18.6-100.el9, libsmbclient-4.18.6-100.el9, libwbclient-4.18.6-100.el9 +15
Red Hat Enterprise Linux Resilient Storage (v. 9) ctdb-4.18.6-100.el9

TI-2023-17456 CVE-2023-34966 · GHSA-45c7-642q-qm9m

HIGH 68

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.62295 Published 2023-07-20 Partial fix · 4.18.6-1.el8, 4.15.5-15.el8_6 +3 CWE-835

TI-2023-17457 CVE-2023-34967 · GHSA-86p4-vhr6-2vv3

MEDIUM 59

A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.61199 Published 2023-07-20 Partial fix · 4.18.6-1.el8, 4.15.5-15.el8_6 +2 CWE-843

TI-2022-01968 CVE-2022-2127 · GHSA-mfwc-hx97-869v

LOW 30

An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01722 Published 2023-07-20 Partial fix · 4.18.6-1.el8, 4.15.5-15.el8_6 +2 CWE-125

TI-2023-17458 CVE-2023-34968 · GHSA-cfhp-p6xr-24g5

LOW 27

A path disclosure vulnerability was found in Samba.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01333 Published 2023-07-20 Partial fix · 4.18.6-1.el8, 4.15.5-15.el8_6 +2 CWE-201