Log in Start free

Vulnerability · Published Apr 19, 2021 · Assigned by redhat

CVE-2021-20208

Medium 6.1

In plain English

A medium-severity security flaw in cifs-utils. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

A flaw was found in cifs-utils in versions before 6.13. A user when mounting a krb5 CIFS file system from within a container can use Kerberos credentials of the host. The highest threat from this vulnerability is to data confidentiality and integrity.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20cifs-utils6.13-r0ALPINE-CVE-2021-20208
Alpine:v3.21cifs-utils6.13-r0ALPINE-CVE-2021-20208
Alpine:v3.22cifs-utils6.13-r0ALPINE-CVE-2021-20208
Alpine:v3.23cifs-utils6.13-r0ALPINE-CVE-2021-20208
Alpine:v3.24cifs-utils6.13-r0ALPINE-CVE-2021-20208
Debian:12cifs-utils2:6.11-3DEBIAN-CVE-2021-20208
Debian:13cifs-utils2:6.11-3DEBIAN-CVE-2021-20208
Debian:14cifs-utils2:6.11-3DEBIAN-CVE-2021-20208
Ubuntu:22.04:LTScifs-utils2:6.14-1ubuntu0.1USN-5459-1

Affected products (as reported)

VendorProductVersions
n/a cifs-utils cifs-utils 6.13

Weakness: CWE-266

References