Red Hat Security AdvisoryRHSA-2023:7467
samba security update
Released 2023-11-22 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat CodeReady Linux Builder (v. 8) libnetapi-devel-4.18.6-2.el8_9, libsmbclient-devel-4.18.6-2.el8_9, libwbclient-devel-4.18.6-2.el8_9 +2
- Red Hat Enterprise Linux AppStream (v. 8) samba-vfs-iouring-4.18.6-2.el8_9
- Red Hat Enterprise Linux BaseOS (v. 8) ctdb-4.18.6-2.el8_9, libnetapi-4.18.6-2.el8_9, libsmbclient-4.18.6-2.el8_9 +25
Fixes 3 records
Priority MEDIUM 47
A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02688 · Published 2023-11-03 · Partial fix · 4.18.6-2.el8_9, 4.15.5-13.el8_6 +4 CWE-22
Priority LOW 34
A vulnerability was discovered in Samba, where the flaw allows SMB clients to truncate files, even with read-only permissions when the Samba VFS module "acl_xattr" is configured with "acl_xattr:ignore system acls = yes".
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01334 · Published 2023-11-03 · Partial fix · 4.18.6-2.el8_9, 4.15.5-13.el8_6 +4 CWE-276
Priority LOW 33
A vulnerability was found in Samba's "rpcecho" development server, a non-Windows RPC server used to test Samba's DCE/RPC stack elements.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01941 · Published 2023-11-06 · Partial fix · 4.17.12, 4.18.8 +6 CWE-400
THREATIST.IORead the docs