{"id":"CVE-2020-14342","aliases":["ALPINE-CVE-2020-14342","AZL-6353","CLSA-2026-1792442320","CLSA-2026-1792442514","DEBIAN-CVE-2020-14342","EUVD-2020-6487","GHSA-7mmj-72wg-6gpv","MGASA-2020-0376","SUSE-SU-2020:2728-1","SUSE-SU-2020:2729-1","SUSE-SU-2021:1455-1","UBUNTU-CVE-2020-14342","USN-5459-1","USN-7688-1","openSUSE-SU-2020:1579-1","openSUSE-SU-2021:0639-1","openSUSE-SU-2024:10683-1"],"status":"published","title":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password,...","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","severity":{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00652,"percentile":0.51518,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77","CWE-78"],"published":"2020-09-09T11:13:35Z","modified":"2026-10-26T12:01:29Z","fixes":[{"ecosystem":"Alpine:v3.11","package":"cifs-utils","fixed_in":["6.13-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"cifs-utils","fixed_in":["6.11-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"cifs-utils","fixed_in":["6.8-6"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"cifs-utils","fixed_in":["2:6.11-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"cifs-utils","fixed_in":["2:6.11-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"cifs-utils","fixed_in":["2:6.11-1"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"cifs-utils","fixed_in":["6.9-6.1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"cifs-utils","fixed_in":["6.9-13.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cifs-utils","fixed_in":["6.9-13.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cifs-utils","fixed_in":["6.9-13.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"cifs-utils","fixed_in":["6.9-5.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"cifs-utils","fixed_in":["6.9-5.6.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cifs-utils","fixed_in":["2:6.0-1ubuntu2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cifs-utils","fixed_in":["2:6.4-1ubuntu1.1+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"cifs-utils","fixed_in":["2:6.8-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"cifs-utils","fixed_in":["2:6.9-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"cifs-utils","fixed_in":["6.9-lp151.4.7.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.11","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6"},{"fixed":"6.13-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.6"},{"fixed":"6.11-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.8-6"}]}]},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-10.el7.0.5.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:RHEL:7","package":"cifs-utils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-10.el7.0.5.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-10.el7.0.5.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"TuxCare:OracleLinux:7","package":"cifs-utils-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.2-10.el7.0.5.tuxcare.els3"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.11-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.11-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.11-1"}]}]},{"source":"osv","ecosystem":"Mageia:7","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-6.1.mga7"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12 SP5","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-13.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-13.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-13.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP1","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-5.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-ESPOS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15-LTSS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15-LTSS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-3.14.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.0-1ubuntu2+esm1"}]}],"versions":["2:6.0-1ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.4-1ubuntu1.1+esm1"}]}],"versions":["2:6.4-1ubuntu1","2:6.4-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.8-1ubuntu1.2"}]}],"versions":["2:6.7-1","2:6.8-1","2:6.8-1ubuntu1","2:6.8-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.9-1ubuntu0.2"}]}],"versions":["2:6.9-0ubuntu1","2:6.9-1","2:6.9-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.8-1ubuntu1.2"}]}],"versions":["2:6.7-1","2:6.8-1","2:6.8-1ubuntu1","2:6.8-1ubuntu1.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.9-1ubuntu0.2"}]}],"versions":["2:6.9-0ubuntu1","2:6.9-1","2:6.9-1ubuntu0.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.14-1ubuntu0.1"}]}],"versions":["2:6.11-3.1","2:6.14-1","2:6.14-1build1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.0-1ubuntu2+esm1"}]}],"versions":["2:6.0-1ubuntu2"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.4-1ubuntu1.1+esm1"}]}],"versions":["2:6.4-1ubuntu1","2:6.4-1ubuntu1.1"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-lp151.4.7.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.9-lp152.2.3.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"cifs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.13-1.3"}]}],"bundled":16}],"products":[{"vendor":"cifs-utils","product":"cifs-utils"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"opensuse","product":"leap"},{"vendor":"samba","product":"cifs-utils"}],"references":[{"url":"https://lists.samba.org/archive/samba-technical/2020-September/135747.html","tags":["x_refsource_MISC","x_transferred","Exploit","Mailing List","Vendor Advisory","evidence","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-14342","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://security.gentoo.org/glsa/202009-16","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00109.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DUMRICFXJVCBBOSKZSKT3HFVQM6VPJU3/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JBNFSTJOQWVPFZAUJNNMAPY45PW5RTTE/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-14342","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DUMRICFXJVCBBOSKZSKT3HFVQM6VPJU3/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JBNFSTJOQWVPFZAUJNNMAPY45PW5RTTE/"},{"url":"https://github.com/advisories/GHSA-7mmj-72wg-6gpv"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-14342","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/rhel7els/CLSA-2026-1792442320.html","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-27239","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/oraclelinux7els/CLSA-2026-1792442514.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-14342","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2020-0376.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=27315","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2020-September/007471.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202728-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174477","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14342","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20202729-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1152930","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211455-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183239","tags":["report"]},{"url":"https://bugzilla.suse.com/1184815","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20208","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-14342","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5459-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-14342","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7688-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-20208","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-27239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-29869","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/TC64OHNF4BWAKNIMUW3XQQI4EWLKL2HS/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/65NUX6IGI72XJIWLCF5QOKIKAWWJUMEY/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0022","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-14342","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2020-09-09T11:13:35Z","modified":"2024-08-04T12:39:36.529Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:35:46.476719Z"}],"euvd":[{"id":"EUVD-2020-6487","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2020-09-09T11:13:35Z","modified":"2024-08-04T12:39:36Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T03:07:34.636169Z"}],"ghsa":[{"id":"GHSA-7mmj-72wg-6gpv","title":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password,...","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2022-05-24T17:27:37Z","modified":"2023-01-28T05:03:08Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:43:55.102378Z"}],"nvd":[{"id":"CVE-2020-14342","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2020-09-09T12:15:11.21Z","modified":"2026-06-17T02:54:34.33Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.4,"vector":"AV:L/AC:M/Au:N/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-77","CWE-78"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"ALPINE-CVE-2020-14342","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2020-09-09T12:15:11.21Z","modified":"2026-10-26T11:17:55.121204587Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"AZL-6353","title":"CVE-2020-14342 affecting package cifs-utils for versions less than 6.8-6","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2020-09-09T12:15:11Z","modified":"2026-04-21T04:32:10.298643Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"CVE-2020-14342","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2020-09-09T12:15:11.21Z","modified":"2026-10-24T10:30:46.696669778Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:14.418339Z"},{"id":"DEBIAN-CVE-2020-14342","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2020-09-09T12:15:11.21Z","modified":"2026-10-26T12:01:29.61667305Z","cvss":[{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:32.862554Z"},{"id":"UBUNTU-CVE-2020-14342","description":"It was found that cifs-utils' mount.cifs was invoking a shell when requesting the Samba password, which could be used to inject arbitrary commands. An attacker able to invoke mount.cifs with special permission, such as via sudo rules, could use this flaw to escalate their privileges.","status":"published","published":"2020-09-09T12:15:00Z","modified":"2026-02-04T02:26:24.764967Z","cvss":[{"version":"3.1","score":4.4,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:22.804634Z"},{"id":"CLSA-2026-1792442320","title":"cifs-utils: Fix of CVE-2022-27239","description":"- CVE-2020-14342: mount.cifs shell command injection via username mount\n  option when built with systemd-ask-password support","status":"published","published":"2026-10-19T20:38:51Z","modified":"2026-10-26T09:43:44.452020403Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"CLSA-2026-1792442514","title":"cifs-utils: Fix of CVE-2022-27239","description":"- CVE-2020-14342: mount.cifs shell command injection via username mount\n  option when built with systemd-ask-password support","status":"published","published":"2026-10-19T20:42:06Z","modified":"2026-10-26T09:43:50.143894557Z","updated_at":"2026-11-02T15:43:54.378946Z"},{"id":"MGASA-2020-0376","title":"Updated cifs-utils packages fix security vulnerability","description":"The mount.cifs utility has a shell injection issue where one can embed shell\ncommands via the username mount option. Those commands will be run via popen()\nin the context of the user calling mount (CVE-2020-14342).\n","status":"published","published":"2020-09-27T20:06:37Z","modified":"2026-04-16T04:44:21.059258968Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2020:1579-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issues:\n\n- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477). \n- Fixed an invalid free in mount.cifs; (bsc#1152930).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2020-09-29T22:21:05Z","modified":"2026-02-04T03:50:28.221674Z","updated_at":"2026-11-02T16:58:31.517538Z"},{"id":"openSUSE-SU-2021:0639-1","title":"Security update for cifs-utils","description":"\nThis update for cifs-utils fixes the following security issues:\n\n- CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. (bsc#1183239)\n- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. (bsc#1174477)\n\nThis update for cifs-utils fixes the following issues:\n\n- Solve invalid directory mounting. When attempting to change the current\n  working directory into non-existing directories, mount.cifs crashes.\n  (bsc#1152930)\n\n- Fixed a bug where it was no longer possible to mount CIFS filesystem after\n  the last maintenance update. (bsc#1184815)\n\nThis update was imported from the SUSE:SLE-15:Update update project.","status":"published","published":"2021-04-30T19:23:06Z","modified":"2026-02-04T03:03:04.703354Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2024:10683-1","title":"cifs-utils-6.13-1.3 on GA media","description":"These are all security issues fixed in the cifs-utils-6.13-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:27:26.032876Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2020:2728-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issues:\n\n- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477). \n","status":"published","published":"2020-09-23T14:00:23Z","modified":"2026-02-04T02:30:54.024031Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2020:2729-1","title":"Security update for cifs-utils","description":"This update for cifs-utils fixes the following issues:\n\n- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs (bsc#1174477). \n- Fixed an invalid free in mount.cifs; (bsc#1152930).\n","status":"published","published":"2020-09-23T14:01:03Z","modified":"2026-02-04T04:28:50.207666Z","updated_at":"2026-11-02T15:53:48.11786Z"},{"id":"SUSE-SU-2021:1455-1","title":"Security update for cifs-utils","description":"\nThis update for cifs-utils fixes the following security issues:\n\n- CVE-2021-20208: Fixed a potential kerberos auth leak escaping from container. (bsc#1183239)\n- CVE-2020-14342: Fixed a shell command injection vulnerability in mount.cifs. (bsc#1174477)\n\nThis update for cifs-utils fixes the following issues:\n\n- Solve invalid directory mounting. When attempting to change the current\n  working directory into non-existing directories, mount.cifs crashes.\n  (bsc#1152930)\n\n- Fixed a bug where it was no longer possible to mount CIFS filesystem after\n  the last maintenance update. (bsc#1184815)\n","status":"published","published":"2021-04-30T09:58:58Z","modified":"2026-02-04T04:27:04.455621Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"USN-5459-1","title":"cifs-utils vulnerabilities","description":"Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a\npassword. In certain environments, a local attacker could possibly use this\nissue to escalate privileges. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2020-14342)\n\nIt was discovered that cifs-utils incorrectly used host credentials when\nmounting a krb5 CIFS file system from within a container. An attacker\ninside a container could possibly use this issue to obtain access to\nsensitive information. This issue only affected Ubuntu 18.04 LTS and Ubuntu\n20.04 LTS. (CVE-2021-20208)\n\nIt was discovered that cifs-utils incorrectly handled certain command-line\narguments. A local attacker could possibly use this issue to obtain root\nprivileges. (CVE-2022-27239)\n\nIt was discovered that cifs-utils incorrectly handled verbose logging. A\nlocal attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2022-29869)\n","status":"published","published":"2022-06-02T16:41:26Z","modified":"2026-02-10T04:42:38Z","updated_at":"2026-11-02T16:58:16.20937Z"},{"id":"USN-7688-1","title":"cifs-utils vulnerabilities","description":"Aurélien Aptel discovered that cifs-utils invoked a shell when requesting a\npassword. In certain environments, a local attacker could possibly use this\nissue to escalate privileges. (CVE-2020-14342)\n\nIt was discovered that cifs-utils incorrectly used host credentials when\nmounting a krb5 CIFS file system from within a container. An attacker\ninside a container could possibly use this issue to obtain access to\nsensitive information. (CVE-2021-20208)\n\nIt was discovered that cifs-utils incorrectly handled certain command-line\narguments. A local attacker could possibly use this issue to obtain root\nprivileges. (CVE-2022-27239)\n\nIt was discovered that cifs-utils incorrectly handled verbose logging. A\nlocal attacker could possibly use this issue to obtain sensitive\ninformation. (CVE-2022-29869)","status":"published","published":"2025-08-07T09:24:31Z","modified":"2026-06-25T13:32:30.715866707Z","updated_at":"2026-11-02T16:58:21.91885Z"}]}}