Homepage
About Snyk

Information Exposure Affecting samba package, versions [3.0.0,4.13.14) [4.14.0,4.14.10) [4.15.0,4.15.2)

0.0
medium

Snyk CVSS

    Attack Complexity High
    Confidentiality High
    Integrity High

    Threat Intelligence

    EPSS 0.14% (49th percentile)
Expand this section
NVD
5.9 medium
Expand this section
SUSE
6.8 medium
Expand this section
Red Hat
6.8 medium

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-UNMANAGED-SAMBA-2936545
  • published 29 Jun 2022
  • disclosed 28 Jun 2022
  • credit Stefan Metzmacher
Report a new vulnerability Found a mistake?

Introduced: 28 Jun 2022

CVE-2016-2124 Open this link in a new tab
CWE-287 Open this link in a new tab

How to fix?

Upgrade samba to version 4.13.14, 4.14.10, 4.15.2 or higher.

Overview

Affected versions of this package are vulnerable to Information Exposure via the SMB1 implementation of authentication. An attacker could exploit this vulnerability to retrieve the plaintext password sent over the wire even if Kerberos authentication was required.

Note: Exploiting this vulnerability is only possible when SMB1 is enabled.