Log in Start free

Vulnerability · Published Oct 29, 2020 · Assigned by redhat

CVE-2020-14323

Medium 5.5

In plain English

A medium-severity security flaw in Samba. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 50% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.5Medium
Exploit odds (30 days)0.6%top 50.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A null pointer dereference flaw was found in samba's Winbind service in versions before 4.11.15, before 4.12.9 and before 4.13.1. A local user could use this flaw to crash the winbind service causing denial of service.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8libsmbclient-devel4.13.3-3.el8ALSA-2021:1647
AlmaLinux:8libwbclient-devel4.13.3-3.el8ALSA-2021:1647
AlmaLinux:8openchange2.3-27.el8ALSA-2021:1647
AlmaLinux:8samba-devel4.13.3-3.el8ALSA-2021:1647
Alpine:v3.20samba4.12.9-r0ALPINE-CVE-2020-14323
Alpine:v3.21samba4.12.9-r0ALPINE-CVE-2020-14323
Alpine:v3.22samba4.12.9-r0ALPINE-CVE-2020-14323
Alpine:v3.23samba4.12.9-r0ALPINE-CVE-2020-14323
Alpine:v3.24samba4.12.9-r0ALPINE-CVE-2020-14323
Debian:12samba2:4.13.2+dfsg-2DEBIAN-CVE-2020-14323
Debian:13samba2:4.13.2+dfsg-2DEBIAN-CVE-2020-14323
Debian:14samba2:4.13.2+dfsg-2DEBIAN-CVE-2020-14323
Rocky Linux:8openchange0:2.3-27.el8RLSA-2021:1647
Rocky Linux:8samba0:4.13.3-3.el8RLSA-2021:1647

Affected products (as reported)

VendorProductVersions
n/a Samba All samba versions before 4.11.15, before 4.12.9 and before 4.13.1

Weakness: CWE-170 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References