CVE-2021-23192 Affecting samba-devel package, versions <0:4.13.3-8.el8_4


Severity

Recommended
high

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.19% (57th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL8-SAMBADEVEL-4127590
  • published11 Nov 2021
  • disclosed9 Nov 2021

Introduced: 9 Nov 2021

CVE-2021-23192  (opens in a new tab)

How to fix?

Upgrade RHEL:8 samba-devel to version 0:4.13.3-8.el8_4 or higher.
This issue was patched in RHSA-2022:0008.

NVD Description

Note: Versions mentioned in the description apply only to the upstream samba-devel package and not the samba-devel package as distributed by RHEL. See How to fix? for RHEL:8 relevant fixed versions and status.

A flaw was found in the way samba implemented DCE/RPC. If a client to a Samba server sent a very large DCE/RPC request, and chose to fragment it, an attacker could replace later fragments with their own data, bypassing the signature requirements.

CVSS Scores

version 3.1