Link Following Affecting samba package, versions <4.16.6-r0


Severity

Recommended
0.0
medium
0
10

Snyk's Security Team recommends NVD's CVSS assessment. Learn more

Threat Intelligence

EPSS
0.18% (56th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-ALPINE320-SAMBA-7011411
  • published23 May 2024
  • disclosed12 Jan 2023

Introduced: 12 Jan 2023

CVE-2022-3592  (opens in a new tab)
CWE-59  (opens in a new tab)

How to fix?

Upgrade Alpine:3.20 samba to version 4.16.6-r0 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream samba package and not the samba package as distributed by Alpine. See How to fix? for Alpine:3.20 relevant fixed versions and status.

A symlink following vulnerability was found in Samba, where a user can create a symbolic link that will make 'smbd' escape the configured share path. This flaw allows a remote user with access to the exported part of the file system under a share via SMB1 unix extensions or NFS to create symlinks to files outside the 'smbd' configured share path and gain access to another restricted server's filesystem.

CVSS Base Scores

version 3.1