{"id":"CVE-2020-25722","aliases":["ALPINE-CVE-2020-25722","AZL-36996","AZL-8651","CLSA-2026-1777945598","DEBIAN-CVE-2020-25722","DSA-5003-1","EUVD-2020-18376","GHSA-5hcc-fcfj-mj9h","MGASA-2021-0585","OESA-2021-1461","SUSE-SU-2021:3647-1","SUSE-SU-2022:0361-1","UBUNTU-CVE-2020-25722","USN-5142-1","USN-5174-1","openSUSE-SU-2021:3647-1","openSUSE-SU-2024:11631-1"],"status":"published","title":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of...","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01606,"percentile":0.76196,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-863"],"published":"2021-11-09T00:00:00Z","modified":"2026-10-26T12:02:30Z","fixes":[{"ecosystem":"Alpine:v3.13","package":"samba","fixed_in":["4.13.17-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"samba","fixed_in":["4.14.12-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"samba","fixed_in":["4.15.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"samba","fixed_in":["4.18.3-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.13.14+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.13.14+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.13.14+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"samba","fixed_in":["2:4.7.6+dfsg~ubuntu-0ubuntu2.26"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"samba","fixed_in":["2:4.13.14+dfsg-0ubuntu0.20.04.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"samba","fixed_in":["2:4.13.14+dfsg-0ubuntu1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.13.17-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.12-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.15.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.12.5-7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"ctdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libnss-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libpam-winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libparse-pidl-perl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libsmbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libsmbclient-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwbclient-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libwbclient0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"python-samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"registry-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"samba-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"samba-common-bin","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"samba-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"samba-dsdb-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"samba-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"samba-testsuite","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"samba-vfs-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"smbclient","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"winbind","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.3.11+dfsg-0ubuntu0.16.04.34+tuxcare.els10"}]}],"bundled":3},{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.14+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.14+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.14+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.13+dfsg-1~deb11u2"}]}],"versions":["2:4.13.13+dfsg-1~deb11u1","2:4.13.5+dfsg-2"],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.11-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.3.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:8","package":"talloc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-1.mga8"}]}],"bundled":8},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.12-8.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.12-8.oe1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.13+git.528.140935f8d6a-3.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.13+git.528.140935f8d6a-3.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.13+git.528.140935f8d6a-3.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-4.6.1"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.13+git.545.5897c2d94f3-3.12.1"}]}],"bundled":11},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:3.6.18-1ubuntu3","2:4.0.10+dfsg-4ubuntu2","2:4.0.13+dfsg-1ubuntu1","2:4.1.3+dfsg-2ubuntu2","2:4.1.3+dfsg-2ubuntu3","2:4.1.3+dfsg-2ubuntu4","2:4.1.3+dfsg-2ubuntu5","2:4.1.6+dfsg-1ubuntu1","2:4.1.6+dfsg-1ubuntu2","2:4.1.6+dfsg-1ubuntu2.14.04.1","2:4.1.6+dfsg-1ubuntu2.14.04.2","2:4.1.6+dfsg-1ubuntu2.14.04.3","2:4.1.6+dfsg-1ubuntu2.14.04.4","2:4.1.6+dfsg-1ubuntu2.14.04.5","2:4.1.6+dfsg-1ubuntu2.14.04.7","2:4.1.6+dfsg-1ubuntu2.14.04.8","2:4.1.6+dfsg-1ubuntu2.14.04.9","2:4.1.6+dfsg-1ubuntu2.14.04.11","2:4.1.6+dfsg-1ubuntu2.14.04.12","2:4.1.6+dfsg-1ubuntu2.14.04.13","2:4.3.8+dfsg-0ubuntu0.14.04.2","2:4.3.9+dfsg-0ubuntu0.14.04.1","2:4.3.9+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.1","2:4.3.11+dfsg-0ubuntu0.14.04.2","2:4.3.11+dfsg-0ubuntu0.14.04.3","2:4.3.11+dfsg-0ubuntu0.14.04.4","2:4.3.11+dfsg-0ubuntu0.14.04.6","2:4.3.11+dfsg-0ubuntu0.14.04.7","2:4.3.11+dfsg-0ubuntu0.14.04.8","2:4.3.11+dfsg-0ubuntu0.14.04.9","2:4.3.11+dfsg-0ubuntu0.14.04.10","2:4.3.11+dfsg-0ubuntu0.14.04.11","2:4.3.11+dfsg-0ubuntu0.14.04.12","2:4.3.11+dfsg-0ubuntu0.14.04.13","2:4.3.11+dfsg-0ubuntu0.14.04.14","2:4.3.11+dfsg-0ubuntu0.14.04.16","2:4.3.11+dfsg-0ubuntu0.14.04.17","2:4.3.11+dfsg-0ubuntu0.14.04.19","2:4.3.11+dfsg-0ubuntu0.14.04.20","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm1","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm2","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm3","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm4","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm6","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm7","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm8","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm9","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm11","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm12","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm13","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm14","2:4.3.11+dfsg-0ubuntu0.14.04.20+esm15"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.17+dfsg-4ubuntu2","2:4.1.20+dfsg-1ubuntu1","2:4.1.20+dfsg-1ubuntu2","2:4.1.20+dfsg-1ubuntu3","2:4.1.20+dfsg-1ubuntu5","2:4.3.3+dfsg-1ubuntu1","2:4.3.3+dfsg-1ubuntu2","2:4.3.3+dfsg-1ubuntu3","2:4.3.6+dfsg-1ubuntu1","2:4.3.8+dfsg-0ubuntu1","2:4.3.9+dfsg-0ubuntu0.16.04.1","2:4.3.9+dfsg-0ubuntu0.16.04.2","2:4.3.9+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.1","2:4.3.11+dfsg-0ubuntu0.16.04.3","2:4.3.11+dfsg-0ubuntu0.16.04.5","2:4.3.11+dfsg-0ubuntu0.16.04.6","2:4.3.11+dfsg-0ubuntu0.16.04.7","2:4.3.11+dfsg-0ubuntu0.16.04.8","2:4.3.11+dfsg-0ubuntu0.16.04.9","2:4.3.11+dfsg-0ubuntu0.16.04.10","2:4.3.11+dfsg-0ubuntu0.16.04.11","2:4.3.11+dfsg-0ubuntu0.16.04.12","2:4.3.11+dfsg-0ubuntu0.16.04.13","2:4.3.11+dfsg-0ubuntu0.16.04.15","2:4.3.11+dfsg-0ubuntu0.16.04.16","2:4.3.11+dfsg-0ubuntu0.16.04.17","2:4.3.11+dfsg-0ubuntu0.16.04.18","2:4.3.11+dfsg-0ubuntu0.16.04.19","2:4.3.11+dfsg-0ubuntu0.16.04.20","2:4.3.11+dfsg-0ubuntu0.16.04.21","2:4.3.11+dfsg-0ubuntu0.16.04.23","2:4.3.11+dfsg-0ubuntu0.16.04.24","2:4.3.11+dfsg-0ubuntu0.16.04.25","2:4.3.11+dfsg-0ubuntu0.16.04.26","2:4.3.11+dfsg-0ubuntu0.16.04.27","2:4.3.11+dfsg-0ubuntu0.16.04.28","2:4.3.11+dfsg-0ubuntu0.16.04.29","2:4.3.11+dfsg-0ubuntu0.16.04.30","2:4.3.11+dfsg-0ubuntu0.16.04.31","2:4.3.11+dfsg-0ubuntu0.16.04.32","2:4.3.11+dfsg-0ubuntu0.16.04.34","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm1","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm2","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm3","2:4.3.11+dfsg-0ubuntu0.16.04.34+esm4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.7.6+dfsg~ubuntu-0ubuntu2.26"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2","2:4.7.6+dfsg~ubuntu-0ubuntu2.2","2:4.7.6+dfsg~ubuntu-0ubuntu2.4","2:4.7.6+dfsg~ubuntu-0ubuntu2.5","2:4.7.6+dfsg~ubuntu-0ubuntu2.6","2:4.7.6+dfsg~ubuntu-0ubuntu2.7","2:4.7.6+dfsg~ubuntu-0ubuntu2.9","2:4.7.6+dfsg~ubuntu-0ubuntu2.10","2:4.7.6+dfsg~ubuntu-0ubuntu2.11","2:4.7.6+dfsg~ubuntu-0ubuntu2.13","2:4.7.6+dfsg~ubuntu-0ubuntu2.14","2:4.7.6+dfsg~ubuntu-0ubuntu2.15","2:4.7.6+dfsg~ubuntu-0ubuntu2.16","2:4.7.6+dfsg~ubuntu-0ubuntu2.17","2:4.7.6+dfsg~ubuntu-0ubuntu2.18","2:4.7.6+dfsg~ubuntu-0ubuntu2.19","2:4.7.6+dfsg~ubuntu-0ubuntu2.20","2:4.7.6+dfsg~ubuntu-0ubuntu2.21","2:4.7.6+dfsg~ubuntu-0ubuntu2.23","2:4.7.6+dfsg~ubuntu-0ubuntu2.24"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.14+dfsg-0ubuntu0.20.04.1"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4","2:4.11.5+dfsg-1ubuntu1","2:4.11.5+dfsg-1ubuntu2","2:4.11.6+dfsg-0ubuntu1","2:4.11.6+dfsg-0ubuntu1.1","2:4.11.6+dfsg-0ubuntu1.2","2:4.11.6+dfsg-0ubuntu1.3","2:4.11.6+dfsg-0ubuntu1.4","2:4.11.6+dfsg-0ubuntu1.5","2:4.11.6+dfsg-0ubuntu1.6","2:4.11.6+dfsg-0ubuntu1.8","2:4.11.6+dfsg-0ubuntu1.9","2:4.11.6+dfsg-0ubuntu1.10"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.14+dfsg-0ubuntu1"}]}],"versions":["2:4.13.5+dfsg-2ubuntu2","2:4.13.5+dfsg-2ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.14+dfsg-0ubuntu0.20.04.1"}]}],"versions":["2:4.10.7+dfsg-0ubuntu2","2:4.10.7+dfsg-0ubuntu3","2:4.11.1+dfsg-3ubuntu1","2:4.11.1+dfsg-3ubuntu2","2:4.11.1+dfsg-3ubuntu4","2:4.11.5+dfsg-1ubuntu1","2:4.11.5+dfsg-1ubuntu2","2:4.11.6+dfsg-0ubuntu1","2:4.11.6+dfsg-0ubuntu1.1","2:4.11.6+dfsg-0ubuntu1.2","2:4.11.6+dfsg-0ubuntu1.3","2:4.11.6+dfsg-0ubuntu1.4","2:4.11.6+dfsg-0ubuntu1.5","2:4.11.6+dfsg-0ubuntu1.6","2:4.11.6+dfsg-0ubuntu1.8","2:4.11.6+dfsg-0ubuntu1.9","2:4.11.6+dfsg-0ubuntu1.10"],"bundled":9},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.7.6+dfsg~ubuntu-0ubuntu2.26"}]}],"versions":["2:4.6.7+dfsg-1ubuntu3","2:4.7.1+dfsg-1ubuntu1","2:4.7.3+dfsg-1ubuntu1","2:4.7.4+dfsg-1ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu1","2:4.7.6+dfsg~ubuntu-0ubuntu2","2:4.7.6+dfsg~ubuntu-0ubuntu2.2","2:4.7.6+dfsg~ubuntu-0ubuntu2.4","2:4.7.6+dfsg~ubuntu-0ubuntu2.5","2:4.7.6+dfsg~ubuntu-0ubuntu2.6","2:4.7.6+dfsg~ubuntu-0ubuntu2.7","2:4.7.6+dfsg~ubuntu-0ubuntu2.9","2:4.7.6+dfsg~ubuntu-0ubuntu2.10","2:4.7.6+dfsg~ubuntu-0ubuntu2.11","2:4.7.6+dfsg~ubuntu-0ubuntu2.13","2:4.7.6+dfsg~ubuntu-0ubuntu2.14","2:4.7.6+dfsg~ubuntu-0ubuntu2.15","2:4.7.6+dfsg~ubuntu-0ubuntu2.16","2:4.7.6+dfsg~ubuntu-0ubuntu2.17","2:4.7.6+dfsg~ubuntu-0ubuntu2.18","2:4.7.6+dfsg~ubuntu-0ubuntu2.19","2:4.7.6+dfsg~ubuntu-0ubuntu2.20","2:4.7.6+dfsg~ubuntu-0ubuntu2.21","2:4.7.6+dfsg~ubuntu-0ubuntu2.23","2:4.7.6+dfsg~ubuntu-0ubuntu2.24"],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.2-3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.13+git.528.140935f8d6a-3.12.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.2+git.193.a4d6307f1fd-1.1"}]}],"bundled":9}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"samba","product":"samba"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2019764","tags":["x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://www.samba.org/samba/security/CVE-2020-25722.html","tags":["x_transferred","Mitigation","Vendor Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/202309-06","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25722","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-5hcc-fcfj-mj9h"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-25722","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1777945598.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-25722","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0585.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29641","tags":["report"]},{"url":"https://www.debian.org/security/2021/dsa-5003","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5142-1","tags":["advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-November/009716.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/36K5HNX67LYX5XOVQRL3MSIC5YSJ5M5W/","tags":["web","advisory"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-November/009724.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DJMHDQABDOOUGOYNHF2X56XA57GXYYSN/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/QVXLHLIEQEAN7TGOH56LUEA6P4Y4GIZB/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1461","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2124","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-3738","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25718","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25719","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-25721","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213647-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1014440","tags":["report"]},{"url":"https://bugzilla.suse.com/1192214","tags":["report"]},{"url":"https://bugzilla.suse.com/1192215","tags":["report"]},{"url":"https://bugzilla.suse.com/1192246","tags":["report"]},{"url":"https://bugzilla.suse.com/1192247","tags":["report"]},{"url":"https://bugzilla.suse.com/1192283","tags":["report"]},{"url":"https://bugzilla.suse.com/1192284","tags":["report"]},{"url":"https://bugzilla.suse.com/1192505","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2124","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25717","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25718","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25719","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25721","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-25722","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-23192","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-3738","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220361-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188727","tags":["report"]},{"url":"https://bugzilla.suse.com/1189017","tags":["report"]},{"url":"https://bugzilla.suse.com/1189875","tags":["report"]},{"url":"https://bugzilla.suse.com/1192849","tags":["report"]},{"url":"https://bugzilla.suse.com/1194859","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-17049","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20254","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44142","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-25722","tags":["report"]},{"url":"https://www.samba.org/samba/history/samba-4.13.14.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5174-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-25722","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2016-2124","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25717","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25718","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25719","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2020-25721","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3671","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-3738","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-23192","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2020-25722","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-18T00:00:00Z","modified":"2024-08-04T15:40:36.64Z","cwes":["CWE-863"],"updated_at":"2026-11-02T14:35:48.52216Z"}],"euvd":[{"id":"EUVD-2020-18376","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-18T00:00:00Z","modified":"2024-08-04T15:40:36Z","updated_at":"2026-11-03T03:07:16.74035Z"}],"ghsa":[{"id":"GHSA-5hcc-fcfj-mj9h","title":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of...","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-19T00:01:33Z","modified":"2023-09-17T09:30:18Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:54:46.481792Z"}],"nvd":[{"id":"CVE-2020-25722","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-18T18:15:08.643Z","modified":"2026-06-17T03:07:11.68Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":6.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:06:46.951463Z"}],"osv":[{"id":"ALPINE-CVE-2020-25722","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-18T18:15:08.643Z","modified":"2026-10-26T11:17:55.159477952Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"AZL-36996","title":"CVE-2020-25722 affecting package samba for versions less than 4.18.3-1","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-18T18:15:08Z","modified":"2026-04-21T04:32:59.923845Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-8651","title":"CVE-2020-25722 affecting package samba 4.12.5-7","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-18T18:15:08Z","modified":"2026-04-21T04:34:53.683559Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:10.677811Z"},{"id":"CVE-2020-25722","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-18T18:15:08.643Z","modified":"2026-10-24T10:30:50.663040893Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:15.879068Z"},{"id":"DEBIAN-CVE-2020-25722","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2022-02-18T18:15:08.643Z","modified":"2026-10-26T12:02:30.874215031Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"OESA-2021-1461","title":"samba security update","description":"Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was discovered in the way samba implements SMB1 authentication. Even if Kerberos authentication is required, an attacker can use this flaw to retrieve the clear text password sent over the wire.(CVE-2016-2124)\r\n\r\nSeveral flaws were found in the way that samba AD DC implements storage data access and consistency checking. Attackers can use this flaw to cause damage to the entire domain.(CVE-2020-25722)\r\n\r\nA use-after-free issue was found in the Samba AD DC RPC server, which may allow handles to point to different user states, leading to more privileged access.(CVE-2021-3738)\r\n\r\nA flaw was found in the way that samba as an AD domain controller can support RODC. This will allow RODC to print administrator credentials.(CVE-2020-25718)\r\n\r\nA flaw was discovered in the way that Samba, as an AD domain controller, implements Kerberos name-based authentication. If Samba AD DC does not strictly require Kerberos PAC and always uses the SID found in it, it may not be able to distinguish the user represented by the credential.(CVE-2020-25719)\r\n\r\nThe AD Kerberos acceptance service in Samba cannot perform authorization by accessing the user's unique and long-term stable identifier.(CVE-2020-25721)","status":"published","published":"2021-12-10T11:04:44Z","modified":"2026-08-18T01:16:13.545491045Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-25722","description":"Multiple flaws were found in the way samba AD DC implemented access and conformance checking of stored data. An attacker could use this flaw to cause total domain compromise.","status":"published","published":"2021-11-09T00:00:00Z","modified":"2026-04-22T12:35:56.063034Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:23.905183Z"},{"id":"CLSA-2026-1777945598","title":"Fix CVE(s): CVE-2020-25717, CVE-2020-25719, CVE-2020-25722","description":"   * SECURITY UPDATE: domain user can become root on a domain member by\n     renaming a machine account\n     - debian/patches/CVE-2020-25717.patch: backport the el6/ol6 8-commit\n       subset (samba 3.6.23 precedent); introduce the new \"min domain\n       uid\" smb.conf parameter (default 1000) and enforce it in\n       check_account() so a domain logon resolving to a uid below the\n       threshold is rejected with NT_STATUS_INVALID_TOKEN, drop the\n       DOMAIN\\user to user prefix-stripping fallback in smb_getpwnam(),\n       stop autocreating local users from check_account() and from the\n       kerberos guest fallback by passing create=false, drop the\n       !winbind_ping() branch in create_local_token() so a missing\n       winbindd no longer silently switches the unix-token computation,\n       and require a PAC in any domain mode (DC or member) inside\n       gensec_generate_session_info_pac() returning\n       NT_STATUS_NO_IMPERSONATION_TOKEN otherwise (the gensec hunk is the\n       jointly tagged CVE-2020-25717+CVE-2020-25719 commit, so this\n       update also delivers the member-server portion of CVE-2020-25719;\n       the DC-side portion of CVE-2020-25719 is tracked separately under\n       ELSCVE-104393)\n     - CVE-2020-25717\n   * SECURITY UPDATE: privileged attribute escalation and structural\n     objectclass change in active directory ldap server\n     - debian/patches/CVE-2020-25722.patch: in\n       source4/dsdb/samdb/ldb_modules/objectclass.c, capture the current\n       structural objectclass at the start of objectclass_do_mod and\n       reject any modify that would change it; in\n       source4/dsdb/samdb/ldb_modules/samldb.c, factor the domain\n       ntSecurityDescriptor lookup into samldb_get_domain_secdesc() and\n       add samldb_check_sensitive_attributes() invoked from samldb_add()\n       and samldb_modify() to refuse non-system writes to sidHistory,\n       gate msDS-SecondaryKrbTgtNumber on the DS-Install-Replica\n       extended right, and gate msDS-AllowedToDelegateTo on\n       SePrivEnableDelegation\n     - CVE-2020-25722","status":"published","published":"2026-05-05T01:46:44Z","modified":"2026-06-04T10:03:34.406727Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"DSA-5003-1","title":"samba - security update","status":"published","published":"2021-11-09T00:00:00Z","modified":"2026-03-09T02:10:51.139375Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2021-0585","title":"Updated samba packages fix security vulnerability","description":"Multiple security issues affecting ldb, samba and sssd. See references for\ndetails.\n","status":"published","published":"2021-12-26T00:14:13Z","modified":"2026-04-16T04:42:28.385670491Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:3647-1","title":"Security update for samba and ldb","description":"This update for samba and ldb fixes the following issues:\n\n- CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).\n- CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).\n- CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).\n- CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).\n- CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).\n- CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).\n- CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).\n- CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).\n\nSamba was updated to 4.13.13\n\n* rodc_rwdc test flaps;(bso#14868).\n* Backport bronze bit fixes, tests, and selftest improvements;\n  (bso#14881).\n* Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]\n  'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba\n  with embedded Heimdal;(bso#14642).\n* Python ldb.msg_diff() memory handling failure;(bso#14836).\n* 'in' operator on ldb.Message is case sensitive;(bso#14845).\n* Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).\n* Allow special chars like '@' in samAccountName when generating\n  the salt;(bso#14874).\n* Fix transit path validation;(bso#12998).\n* Prepare to operate with MIT krb5 \u003e= 1.20;(bso#14870).\n* rpcclient NetFileEnum and net rpc file both cause lock order\n  violation: brlock.tdb, share_entries.tdb;(bso#14645).\n* Python ldb.msg_diff() memory handling failure;(bso#14836).\n* Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).\n\nSamba was updated to 4.13.12:\n\n* Address a signifcant performance regression in database access\n  in the AD DC since Samba 4.12;(bso#14806).\n* Fix performance regression in lsa_LookupSids3/LookupNames4\n  since Samba 4.9 by using an explicit database handle cache;\n  (bso#14807).\n* An unuthenticated user can crash the AD DC KDC by omitting the\n  server name in a TGS-REQ;(bso#14817).\n* Address flapping samba_tool_drs_showrepl test;(bso#14818).\n* Address flapping dsdb_schema_attributes test;(bso#14819).\n* An unuthenticated user can crash the AD DC KDC by omitting the\n  server name in a TGS-REQ;(bso#14817).\n* Fix CTDB flag/status update race conditions(bso#14784).\n\nSamba was updated to 4.13.11:\n\n* smbd: panic on force-close share during offload write; (bso#14769).\n* Fix returned attributes on fake quota file handle and avoid\n  hitting the VFS;(bso#14731).\n* smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).\n* net conf list crashes when run as normal user;(bso#14787).\n* Work around special SMB2 READ response behavior of NetApp Ontap\n  7.3.7;(bso#14607).\n* Start the SMB encryption as soon as possible;(bso#14793).\n* Winbind should not start if the socket path for the privileged\n  pipe is too long;(bso#14792).\n\nldb was updated to 2.2.2:\n\n+ CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558)\n+ CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)\n\nRelease ldb 2.2.2\n\n+ Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).\n+ Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)\n+ Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).\n","status":"published","published":"2021-11-10T16:34:22Z","modified":"2025-05-07T18:09:18.402649Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:11631-1","title":"ctdb-4.15.2+git.193.a4d6307f1fd-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.15.2+git.193.a4d6307f1fd-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:22:51.173439Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:3647-1","title":"Security update for samba and ldb","description":"This update for samba and ldb fixes the following issues:\n\n- CVE-2020-25718: Fixed that an RODC can issue (forge) administrator tickets to other servers (bsc#1192246).\n- CVE-2021-3738: Fixed crash in dsdb stack (bsc#1192215).\n- CVE-2016-2124: Fixed not to fallback to non spnego authentication if we require kerberos (bsc#1014440).\n- CVE-2020-25717: Fixed privilege escalation inside an AD Domain where a user could become root on domain members (bsc#1192284).\n- CVE-2020-25719: Fixed AD DC Username based races when no PAC is given (bsc#1192247).\n- CVE-2020-25722: Fixed AD DC UPN vs samAccountName not checked (top-level bug for AD DC validation issues) (bsc#1192283).\n- CVE-2021-23192: Fixed dcerpc requests to don't check all fragments against the first auth_state (bsc#1192214).\n- CVE-2020-25721: Fixed fill in the new HAS_SAM_NAME_AND_SID values (bsc#1192505).\n\nSamba was updated to 4.13.13\n\n* rodc_rwdc test flaps;(bso#14868).\n* Backport bronze bit fixes, tests, and selftest improvements;\n  (bso#14881).\n* Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]\n  'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba\n  with embedded Heimdal;(bso#14642).\n* Python ldb.msg_diff() memory handling failure;(bso#14836).\n* 'in' operator on ldb.Message is case sensitive;(bso#14845).\n* Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).\n* Allow special chars like '@' in samAccountName when generating\n  the salt;(bso#14874).\n* Fix transit path validation;(bso#12998).\n* Prepare to operate with MIT krb5 \u003e= 1.20;(bso#14870).\n* rpcclient NetFileEnum and net rpc file both cause lock order\n  violation: brlock.tdb, share_entries.tdb;(bso#14645).\n* Python ldb.msg_diff() memory handling failure;(bso#14836).\n* Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).\n\nSamba was updated to 4.13.12:\n\n* Address a signifcant performance regression in database access\n  in the AD DC since Samba 4.12;(bso#14806).\n* Fix performance regression in lsa_LookupSids3/LookupNames4\n  since Samba 4.9 by using an explicit database handle cache;\n  (bso#14807).\n* An unuthenticated user can crash the AD DC KDC by omitting the\n  server name in a TGS-REQ;(bso#14817).\n* Address flapping samba_tool_drs_showrepl test;(bso#14818).\n* Address flapping dsdb_schema_attributes test;(bso#14819).\n* An unuthenticated user can crash the AD DC KDC by omitting the\n  server name in a TGS-REQ;(bso#14817).\n* Fix CTDB flag/status update race conditions(bso#14784).\n\nSamba was updated to 4.13.11:\n\n* smbd: panic on force-close share during offload write; (bso#14769).\n* Fix returned attributes on fake quota file handle and avoid\n  hitting the VFS;(bso#14731).\n* smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).\n* net conf list crashes when run as normal user;(bso#14787).\n* Work around special SMB2 READ response behavior of NetApp Ontap\n  7.3.7;(bso#14607).\n* Start the SMB encryption as soon as possible;(bso#14793).\n* Winbind should not start if the socket path for the privileged\n  pipe is too long;(bso#14792).\n\nldb was updated to 2.2.2:\n\n+ CVE-2020-25718: samba: An RODC can issue (forge) administrator tickets to other servers; (bsc#1192246); (bso#14558)\n+ CVE-2021-3738: samba: crash in dsdb stack; (bsc#1192215);(bso#14848)\n\nRelease ldb 2.2.2\n\n+ Corrected python behaviour for 'in' for LDAP attributes contained as part of ldb.Message;(bso#14845).\n+ Fix memory handling in ldb.msg_diff Corrected python docstrings;(bso#14836)\n+ Backport bronze bit fixes, tests, and selftest improvements; (bso#14881).\n","status":"published","published":"2021-11-10T16:34:26Z","modified":"2026-02-04T02:17:20.958528Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:0361-1","title":"Security update for ldb, samba","description":"This update for ldb, samba fixes the following issues:\n\nChanges in ldb:\n\n+ CVE-2020-25718: An RODC can issue (forge) administrator\n  tickets to other servers; (bsc#1192246)\n+ CVE-2021-3738: Fixed a crash in dsdb stack (bsc#1192215)\n\nRelease ldb 2.2.2\n\n+ Corrected python behaviour for 'in' for LDAP attributes\n  contained as part of ldb.Message\n+ Fix memory handling in ldb.msg_diff\n+ Backport bronze bit fixes, tests, and selftest improvements.\n\nChanges in samba:\n\n- CVE-2021-44142: Fixed an Out-of-Bound Read/Write on Samba vfs_fruit\n  module; (bsc#1194859)\n\n- The username map [script] advice from CVE-2020-25717 advisory\n  note has undesired side effects for the local nt token. Fallback\n  to a SID/UID based mapping if the name based lookup fails;\n  (bsc#1192849); (bso#14901).\n\n- Fix regression introduced by CVE-2020-25717 patches, winbindd\n  does not start when 'allow trusted domains' is off; (bso#14899);\n\n- CVE-2020-25717: Fixed that a user on the domain can become root on\n  domain members; (bsc#1192284); (bso#14556).\n- CVE-2020-25721: auth: Fill in the new HAS_SAM_NAME_AND_SID\n  values; (bsc#1192505); (bso#14564).\n- CVE-2020-25718: An RODC can issue (forge) administrator tickets\n  to other servers; (bsc#1192246);(bso#14558).\n- CVE-2020-25719: Fixed AD DC Username based races when no PAC\n  is given;(bsc#1192247);(bso#14561).\n- CVE-2020-25722: Fixed that AD DC UPN vs samAccountName not checked\n  (top-level bug for AD DC validation issues);(bsc#1192283);\n  (bso#14564).\n- CVE-2021-3738: Fixed a crash in dsdb stack;(bsc#1192215);\n  (bso#14468).\n- CVE-2021-23192: Fixed that dcerpc requests don't check all fragments\n  against the first auth_state;(bsc#1192214);(bso#14875).\n\n- CVE-2016-2124: don't fallback to non spnego authentication if we\n  require kerberos; (bsc#1014440); (bso#12444).\n\nUpdate to 4.13.13\n\n   * rodc_rwdc test flaps;(bso#14868).\n   * Backport bronze bit fixes, tests, and selftest improvements;\n     (bso#14881).\n   * Provide a fix for MS CVE-2020-17049 in Samba [SECURITY]\n     'Bronze bit' S4U2Proxy Constrained Delegation bypass in Samba\n     with embedded Heimdal;(bso#14642).\n   * Python ldb.msg_diff() memory handling failure;(bso#14836).\n   * 'in' operator on ldb.Message is case sensitive;(bso#14845).\n   * Fix Samba support for UF_NO_AUTH_DATA_REQUIRED;(bso#14871).\n   * Allow special chars like '@' in samAccountName when generating\n     the salt;(bso#14874).\n   * Fix transit path validation;(bso#12998).\n   * Prepare to operate with MIT krb5 \u003e= 1.20;(bso#14870).\n   * rpcclient NetFileEnum and net rpc file both cause lock order\n     violation: brlock.tdb, share_entries.tdb;(bso#14645).\n   * Python ldb.msg_diff() memory handling failure;(bso#14836).\n   * Release LDB 2.3.1 for Samba 4.14.9;(bso#14848).\n\n- Update to 4.13.12\n\n   * Address a signifcant performance regression in database access\n     in the AD DC since Samba 4.12;(bso#14806).\n   * Fix performance regression in lsa_LookupSids3/LookupNames4\n     since Samba 4.9 by using an explicit database handle cache;\n     (bso#14807).\n   * An unuthenticated user can crash the AD DC KDC by omitting the\n     server name in a TGS-REQ;(bso#14817).\n   * Address flapping samba_tool_drs_showrepl test;(bso#14818).\n   * Address flapping dsdb_schema_attributes test;(bso#14819).\n   * An unuthenticated user can crash the AD DC KDC by omitting the\n     server name in a TGS-REQ;(bso#14817).\n   * Fix CTDB flag/status update race conditions(bso#14784).\n\n- Update to 4.13.11\n\n   * smbd: panic on force-close share during offload write;\n     (bso#14769).\n   * Fix returned attributes on fake quota file handle and avoid\n     hitting the VFS;(bso#14731).\n   * smbd: 'deadtime' parameter doesn't work anymore;(bso#14783).\n   * net conf list crashes when run as normal user;(bso#14787).\n   * Work around special SMB2 READ response behavior of NetApp Ontap\n     7.3.7;(bso#14607).\n   * Start the SMB encryption as soon as possible;(bso#14793).\n   * Winbind should not start if the socket path for the privileged\n     pipe is too long;(bso#14792).\n\n- Fix 'net rpc' authentication when using the machine account;\n  (bsc#1189017); (bso#14796);\n\n- Fix dependency problem upgrading from libndr0 to libndr1;\n  (bsc#1189875);\n- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2;\n  (bsc#1189875);\n- Fix wrong kvno exported to keytab after net ads changetrustpw due\n  to replication delay; (bsc#1188727);\n- Add Certificate Auto Enrollment Policy; (jsc#SLE-18456).\n\n- Update to 4.13.10\n\n  * s3: smbd: Ensure POSIX default ACL is mapped into returned\n    Windows ACL for directory handles; (bso#14708);\n  * Take a copy to make sure we don't reference free'd memory; (bso#14721);\n  * s3: lib: Fix talloc heirarcy error in parent_smb_fname(); (bso#14722);\n  * s3: smbd: Remove erroneous TALLOC_FREE(smb_fname_parent) in\n    change_file_owner_to_parent() error path; (bso#14736);\n  * samba-tool: Give better error information when the\n    'domain backup restore' fails with a duplicate SID; (bso#14575);\n  * smbd: Correctly initialize close timestamp fields; (bso#14714);\n  * Spotlight RPC service doesn't work with vfs_glusterfs; (bso#14740);\n  * ctdb: Fix a crash in run_proc_signal_handler(); (bso#14475);\n  * gensec_krb5: Restore ipv6 support for kpasswd; (bso#14750);\n  * smbXsrv_{open,session,tcon}: Protect\n    smbXsrv_{open,session,tcon}_global_traverse_fn against invalid records; (bso#14752);\n  * samba-tool domain backup offline doesn't work against bind DLZ\n    backend; (bso#14027);\n  * netcmd: Use next_free_rid() function to calculate a SID for\n    restoring a backup; (bso#14669);\n\n- Update to 4.13.9\n\n  * s3: smbd: SMB1 SMBsplwr doesn't send a reply packet on success; (bso#14696);\n  * Add documentation for dsdb_group_audit and dsdb_group_json_audit\n    to 'log level', synchronise 'log level' in smb.conf with the code; (bso#14689);\n  * Fix smbd panic when two clients open same file; (bso#14672);\n  * Fix memory leak in the RPC server; (bso#14675);\n  * s3: smbd: Fix deferred renames; (bso#14679);\n  * s3-iremotewinspool: Set the per-request memory context; (bso#14675);\n  * rpc_server3: Fix a memleak for internal pipes; (bso#14675);\n  * third_party: Update socket_wrapper to version 1.3.2; (bso#11899);\n  * third_party: Update socket_wrapper to version 1.3.3; (bso#14639);\n  * idmap_rfc2307 and idmap_nss return wrong mapping for uid/gid\n    conflict; (bso#14663);\n  * Fix the build on OmniOS; (bso#14288);\n\n- Update to 4.13.8\n\n  * CVE-2021-20254: Fix buffer overrun in sids_to_unixids(); (bso#14571\n\n- Update to 4.13.7\n\n  * Release with dependency on ldb version 2.2.1.\n","status":"published","published":"2022-02-10T14:12:34Z","modified":"2026-02-04T02:13:04.762341Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-5142-1","title":"samba vulnerabilities","description":"Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client\nconnections. A remote attacker could possibly use this issue to downgrade\nconnections to plaintext authentication. (CVE-2016-2124)\n\nAndrew Bartlett discovered that Samba incorrectly mapping domain users to\nlocal users. An authenticated attacker could possibly use this issue to\nbecome root on domain members. (CVE-2020-25717)\n\nAndrew Bartlett discovered that Samba did not correctly sandbox Kerberos\ntickets issues by an RODC. An RODC could print administrator tickets,\ncontrary to expectations. (CVE-2020-25718)\n\nAndrew Bartlett discovered that Samba incorrectly handled Kerberos tickets.\nDelegated administrators could possibly use this issue to impersonate\naccounts, leading to total domain compromise. (CVE-2020-25719)\n\nAndrew Bartlett discovered that Samba did not provide stable AD\nidentifiers to Kerberos acceptors. (CVE-2020-25721)\n\nAndrew Bartlett discovered that Samba did not properly check sensitive\nattributes. An authenticated attacker could possibly use this issue to\nescalate privileges. (CVE-2020-25722)\n\nStefan Metzmacher discovered that Samba incorrectly handled certain large\nDCE/RPC requests. A remote attacker could possibly use this issue to\nbypass signature requirements. (CVE-2021-23192)\n\nWilliam Ross discovered that Samba incorrectly handled memory. A remote\nattacker could use this issue to cause Samba to crash, resulting in a\ndenial of service, or possibly escalate privileges. (CVE-2021-3738)\n\nJoseph Sutton discovered that Samba incorrectly handled certain TGS\nrequests. An authenticated attacker could possibly use this issue to cause\nSamba to crash, resulting in a denial of service. (CVE-2021-3671)\n\nThe fix for CVE-2020-25717 results in possible behaviour changes that could\naffect certain environments. Please see the upstream advisory for more\ninformation:\n\nhttps://www.samba.org/samba/security/CVE-2020-25717.html\n","status":"published","published":"2021-11-11T13:02:13Z","modified":"2026-04-27T19:17:38.785898401Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5174-1","title":"samba vulnerabilities","description":"Stefan Metzmacher discovered that Samba incorrectly handled SMB1 client\nconnections. A remote attacker could possibly use this issue to downgrade\nconnections to plaintext authentication. (CVE-2016-2124)\n\nAndrew Bartlett discovered that Samba incorrectly mapping domain users to\nlocal users. An authenticated attacker could possibly use this issue to\nbecome root on domain members. (CVE-2020-25717)\n\nAndrew Bartlett discovered that Samba did not properly check sensitive\nattributes. An authenticated attacker could possibly use this issue to\nescalate privileges. (CVE-2020-25722)\n\nJoseph Sutton discovered that Samba incorrectly handled certain TGS\nrequests. An authenticated attacker could possibly use this issue to cause\nSamba to crash, resulting in a denial of service. (CVE-2021-3671)\n\nThe fix for CVE-2020-25717 results in possible behaviour changes that could\naffect certain environments. Please see the upstream advisory for more\ninformation:\n\nhttps://www.samba.org/samba/security/CVE-2020-25717.html\n","status":"published","published":"2021-12-06T13:29:33Z","modified":"2026-04-27T16:00:31.036737Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}