Red Hat Security Advisory

RHSA-2024:0580

samba security update

Released 2024-01-30 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat CodeReady Linux Builder EUS (v.8.8) libnetapi-devel-4.17.5-5.el8_8, libsmbclient-devel-4.17.5-5.el8_8, libwbclient-devel-4.17.5-5.el8_8 +2
Red Hat Enterprise Linux AppStream EUS (v.8.8) samba-vfs-iouring-4.17.5-5.el8_8
Red Hat Enterprise Linux BaseOS EUS (v.8.8) ctdb-4.17.5-5.el8_8, libnetapi-4.17.5-5.el8_8, libsmbclient-4.17.5-5.el8_8 +25

TI-2023-17456 CVE-2023-34966 · GHSA-45c7-642q-qm9m

HIGH 68

An infinite loop vulnerability was found in Samba's mdssvc RPC service for Spotlight.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.62295 Published 2023-07-20 Partial fix · 4.18.6-1.el8, 4.15.5-15.el8_6 +3 CWE-835

TI-2023-17457 CVE-2023-34967 · GHSA-86p4-vhr6-2vv3

MEDIUM 59

A Type Confusion vulnerability was found in Samba's mdssvc RPC service for Spotlight.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.61199 Published 2023-07-20 Partial fix · 4.18.6-1.el8, 4.15.5-15.el8_6 +2 CWE-843

TI-2022-01968 CVE-2022-2127 · GHSA-mfwc-hx97-869v

LOW 30

An out-of-bounds read vulnerability was found in Samba due to insufficient length checks in winbindd_pam_auth_crap.c.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.01722 Published 2023-07-20 Partial fix · 4.18.6-1.el8, 4.15.5-15.el8_6 +2 CWE-125

TI-2023-17458 CVE-2023-34968 · GHSA-cfhp-p6xr-24g5

LOW 27

A path disclosure vulnerability was found in Samba.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01333 Published 2023-07-20 Partial fix · 4.18.6-1.el8, 4.15.5-15.el8_6 +2 CWE-201