Red Hat Security AdvisoryRHSA-2023:7408
samba security update
Released 2023-11-21 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder EUS (v.8.6) libsmbclient-devel-4.15.5-13.el8_6, libwbclient-devel-4.15.5-13.el8_6, samba-devel-4.15.5-13.el8_6
- Red Hat Enterprise Linux AppStream EUS (v.8.6) samba-vfs-iouring-4.15.5-13.el8_6
- Red Hat Enterprise Linux BaseOS EUS (v.8.6) ctdb-4.15.5-13.el8_6, libsmbclient-4.15.5-13.el8_6, libwbclient-4.15.5-13.el8_6 +18
- Red Hat Virtualization 4 Hypervisor for RHEL 8 libsmbclient-4.15.5-13.el8_6, libwbclient-4.15.5-13.el8_6, samba-4.15.5-13.el8_6 +3
Fixes 3 records
Priority MEDIUM 47
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02688 · Published 2023-11-03 · Partial fix · 4.18.6-2.el8_9, 4.15.5-13.el8_6 +4 CWE-22
Priority LOW 34
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes".
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01334 · Published 2023-11-03 · Partial fix · 4.18.6-2.el8_9, 4.15.5-13.el8_6 +4 CWE-276
Priority LOW 33
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01941 · Published 2023-11-06 · Partial fix · 4.17.12, 4.18.8 +6 CWE-400
THREATIST.IORead the docs