{"id":"CVE-2020-27840","aliases":["ALPINE-CVE-2020-27840","AZL-36997","AZL-45414","AZL-7351","DEBIAN-CVE-2020-27840","DLA-2611-1","DSA-4884-1","EUVD-2020-20338","GHSA-36xh-w73j-574g","MGASA-2021-0287","OESA-2021-1207","SUSE-SU-2021:0944-1","SUSE-SU-2021:0945-1","SUSE-SU-2021:1440-1","SUSE-SU-2021:1444-1","SUSE-SU-2021:1498-1","SUSE-SU-2021:3187-1","SUSE-SU-2022:0283-1","UBUNTU-CVE-2020-27840","USN-4888-1","USN-4888-2","openSUSE-SU-2021:0469-1","openSUSE-SU-2021:0636-1","openSUSE-SU-2021:3187-1","openSUSE-SU-2022:0283-1","openSUSE-SU-2024:10911-1","openSUSE-SU-2024:11365-1"],"status":"published","title":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to...","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.03864,"percentile":0.9027,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2021-03-24T00:00:00Z","modified":"2026-10-26T12:01:08Z","fixes":[{"ecosystem":"Alpine:v3.12","package":"samba","fixed_in":["4.12.14-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.13","package":"samba","fixed_in":["4.13.7-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.14","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"samba","fixed_in":["4.14.2-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"samba","fixed_in":["4.18.3-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"libldb","fixed_in":["2.7.2-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"samba","fixed_in":["2:4.13.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"samba","fixed_in":["2:4.13.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"samba","fixed_in":["2:4.13.13+dfsg-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ldb","fixed_in":["1:1.1.24-0ubuntu0.14.04.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:16.04:LTS","package":"ldb","fixed_in":["2:1.1.24-1ubuntu3.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"ldb","fixed_in":["2:1.2.3-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"ldb","fixed_in":["2:2.0.10-0ubuntu0.20.04.3"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Alpine:v3.12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.12.14-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.13.7-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.14.2-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.18.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"libldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.7.2-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.12.5-7"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.13.13+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.1.27-1+deb9u2"}]}],"versions":["2:1.1.27-1","2:1.1.27-1+deb9u1"],"bundled":2},{"source":"osv","ecosystem":"Debian:10","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.5.1+really1.4.6-3+deb10u1"}]}],"versions":["2:1.5.1+really1.4.6-3"],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.5.8-1.1.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.10.18-1.3.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.3-3.3.mga7"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.5-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.12.15-1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-1.1.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.12-4.oe1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP2","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.6-3.8.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.12-3.6.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.1-4.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.6+git.211.555d60b24ba-3.9.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.14+git.247.8c858f7ee14-4.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.14+git.247.8c858f7ee14-4.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.14+git.247.8c858f7ee14-4.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-ESPOS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP1-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-BCL","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP1-LTSS","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP1","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Manager Server 4.0","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 6","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5+git.432.d9b18c4f390-3.50.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.6+git.211.555d60b24ba-3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.6+git.211.555d60b24ba-3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.6+git.211.555d60b24ba-3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"apparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.6-150300.3.11.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150300.8.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-150300.3.10.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"libapparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.6-150300.3.11.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.4+git.324.8332acf1a63-150300.3.25.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150300.23.17.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"talloc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"talloc-man","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-150300.3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"tdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"tevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP3","package":"tevent-man","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150300.3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 2 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.4+git.324.8332acf1a63-150300.3.25.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"apparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.6-150300.3.11.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150300.8.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Availability Extension 15 SP3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.4+git.324.8332acf1a63-150300.3.25.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"apparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.6-150300.3.11.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150300.8.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-150300.3.10.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"libapparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.6-150300.3.11.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150300.23.17.3"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"talloc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"tdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"tevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.24-0ubuntu0.14.04.2+esm1"}]}],"versions":["1:1.1.15-1.1","1:1.1.16-1","1:1.1.16-1ubuntu0.1","1:1.1.24-0ubuntu0.14.04.1","1:1.1.24-0ubuntu0.14.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.1.24-1ubuntu3.2"}]}],"versions":["2:1.1.20-2","2:1.1.21-1","2:1.1.23-1","2:1.1.23-1ubuntu1","2:1.1.24-1ubuntu1","2:1.1.24-1ubuntu3","2:1.1.24-1ubuntu3.1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.2.3-1ubuntu0.2"}]}],"versions":["2:1.1.29-2","2:1.2.2-2","2:1.2.3-1","2:1.2.3-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.0.10-0ubuntu0.20.04.3"}]}],"versions":["2:1.5.5-0ubuntu2","2:1.5.5-0ubuntu3","2:2.0.7-4","2:2.0.8-1ubuntu1","2:2.0.8-2","2:2.0.10-0ubuntu0.20.04.1","2:2.0.10-0ubuntu0.20.04.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.1.24-1ubuntu3.2"}]}],"versions":["2:1.1.20-2","2:1.1.21-1","2:1.1.23-1","2:1.1.23-1ubuntu1","2:1.1.24-1ubuntu1","2:1.1.24-1ubuntu3","2:1.1.24-1ubuntu3.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:1.2.3-1ubuntu0.2"}]}],"versions":["2:1.1.29-2","2:1.2.2-2","2:1.2.3-1","2:1.2.3-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:2.0.10-0ubuntu0.20.04.3"}]}],"versions":["2:1.5.5-0ubuntu2","2:1.5.5-0ubuntu3","2:2.0.7-4","2:2.0.8-1ubuntu1","2:2.0.8-2","2:2.0.10-0ubuntu0.20.04.1","2:2.0.10-0ubuntu0.20.04.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.1.24-0ubuntu0.14.04.2+esm1"}]}],"versions":["1:1.1.15-1.1","1:1.1.16-1","1:1.1.16-1ubuntu0.1","1:1.1.24-0ubuntu0.14.04.1","1:1.1.24-0ubuntu0.14.04.2"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.12-lp152.2.9.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.11.14+git.247.8c858f7ee14-lp152.3.19.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.13.6+git.211.555d60b24ba-3.7.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"apparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.6-150300.3.11.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"krb5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150300.8.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"krb5-mini","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.19.2-150300.8.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.1-150300.3.10.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"libapparmor","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.13.6-150300.3.11.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.15.4+git.324.8332acf1a63-150300.3.25.3"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"sssd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.16.1-150300.23.17.3"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"talloc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"talloc-man","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.3-150300.3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"tdb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.4-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"tevent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150300.3.3.2"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"tevent-man","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0-150300.3.3.1"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ldb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-1.3"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"samba","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.14.6+git.182.2205d5224e3-1.1"}]}],"bundled":66}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"samba","product":"samba"}],"references":[{"url":"https://security.netapp.com/advisory/ntap-20210326-0007/","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X5J3B6PN5XMXF3OHYBNHDKZ3XFSUGY4L/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/03/msg00036.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://www.debian.org/security/2021/dsa-4884","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZXP3ONIY6MB4C5LDZV4YL5KJCES3UX24/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1941400","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"https://www.samba.org/samba/security/CVE-2020-27840.html","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://security.gentoo.org/glsa/202105-22","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-27840","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VLZ74IF2N75VQSIHBL4B3P5WKWQCXSRY/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X5J3B6PN5XMXF3OHYBNHDKZ3XFSUGY4L/"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZXP3ONIY6MB4C5LDZV4YL5KJCES3UX24/"},{"url":"https://github.com/advisories/GHSA-36xh-w73j-574g"},{"url":"https://security.alpinelinux.org/vuln/CVE-2020-27840","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-27840","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0287.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28686","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=28042","tags":["report"]},{"url":"https://www.samba.org/samba/security/CVE-2021-20277.html","tags":["advisory"]},{"url":"https://www.samba.org/samba/security/CVE-2021-20254.html","tags":["advisory"]},{"url":"https://openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2021-1207","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20254","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-20277","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210944-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1183572","tags":["report"]},{"url":"https://bugzilla.suse.com/1183574","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-27840","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20277","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20210945-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211440-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1182830","tags":["report"]},{"url":"https://bugzilla.suse.com/1184677","tags":["report"]},{"url":"https://bugzilla.suse.com/14571","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20254","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211444-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1178469","tags":["report"]},{"url":"https://bugzilla.suse.com/1179156","tags":["report"]},{"url":"https://bugzilla.suse.com/1184310","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20211498-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213187-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1189875","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220283-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1139519","tags":["report"]},{"url":"https://bugzilla.suse.com/1188571","tags":["report"]},{"url":"https://bugzilla.suse.com/1191227","tags":["report"]},{"url":"https://bugzilla.suse.com/1191532","tags":["report"]},{"url":"https://bugzilla.suse.com/1192684","tags":["report"]},{"url":"https://bugzilla.suse.com/1193690","tags":["report"]},{"url":"https://bugzilla.suse.com/1194859","tags":["report"]},{"url":"https://bugzilla.suse.com/1195048","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-20316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-36222","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-43566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44141","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44142","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-0336","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-27840","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-4888-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-4888-2","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-27840","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2021-20277","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QLNA72I7E6KKMIQOHXHYRPDYGMW5KH4K/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/PJGQFNCBDL3CAZODHIFOKKWU3XGKLEKA/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/ANLZ3MSWRYNRTSO7FPC7CORZ4WAS3YKE/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/72ZRNFZ3DE3TJA7HFCVV476YJN6I4B5M/","tags":["advisory"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3824","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10730","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-1059","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2006-3403","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-0452","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2444","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2446","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-2447","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-4572","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-5398","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2007-6015","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-1105","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-3789","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2008-4314","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-0022","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2123","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2125","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2126","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-11103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12150","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12151","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12163","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-14746","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15275","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-2619","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-7494","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1050","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1057","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10858","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10918","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10919","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1139","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14629","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16841","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16851","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16852","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16853","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-16860","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10197","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-10218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12435","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14833","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14847","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14861","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14907","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-19344","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3870","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3880","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10704","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10745","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10760","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14303","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14318","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14323","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-14383","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-1472","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2020-27840","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T14:06:16Z","modified":"2024-08-04T16:25:43.194Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:35:53.236501Z"}],"euvd":[{"id":"EUVD-2020-20338","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T14:06:16Z","modified":"2024-08-04T16:25:43Z","updated_at":"2026-11-03T03:07:11.950168Z"}],"ghsa":[{"id":"GHSA-36xh-w73j-574g","title":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to...","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2022-05-24T19:02:13Z","modified":"2023-01-29T05:06:15Z","cwes":["CWE-125"],"updated_at":"2026-11-02T14:45:59.056416Z"}],"nvd":[{"id":"CVE-2020-27840","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T15:15:07.543Z","modified":"2026-06-17T03:09:43.1Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:06:39.25999Z"}],"osv":[{"id":"ALPINE-CVE-2020-27840","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T15:15:07.543Z","modified":"2026-10-26T11:17:55.16451245Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:27:48.11886Z"},{"id":"AZL-36997","title":"CVE-2020-27840 affecting package samba for versions less than 4.18.3-1","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T15:15:07Z","modified":"2026-04-21T04:33:26.43188Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-45414","title":"CVE-2020-27840 affecting package libldb for versions less than 2.7.2-1","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T15:15:07Z","modified":"2026-04-21T04:51:52.184788Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:05.694722Z"},{"id":"AZL-7351","title":"CVE-2020-27840 affecting package samba 4.12.5-7","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T15:15:07Z","modified":"2026-04-21T04:33:55.070076Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:09.201912Z"},{"id":"CVE-2020-27840","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T15:15:07.543Z","modified":"2026-10-24T10:30:49.874426546Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:16.248747Z"},{"id":"DEBIAN-CVE-2020-27840","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-05-12T15:15:07.543Z","modified":"2026-10-26T12:01:08.19434768Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:33.729655Z"},{"id":"OESA-2021-1207","title":"samba security update","description":"Samba is a suite of programs for Linux and Unix to interoperate with Windows.\r\n\r\nSecurity Fix(es):\r\n\r\nA flaw was found in samba. The Samba smbd file server must map Windows group identities (SIDs) into unix group ids (gids). The code that performs this had a flaw that could allow it to read data beyond the end of the array in the case where a negative cache entry had been added to the mapping cache. This could cause the calling code to return those values into the process token that stores the group membership for a user. The highest threat from this vulnerability is to data confidentiality and integrity.(CVE-2021-20254)\r\n\r\nA flaw was found in Samba\u0026apos;s libldb. Multiple, consecutive leading spaces in an LDAP attribute can lead to an out-of-bounds memory write, leading to a crash of the LDAP server process handling the request. The highest threat from this vulnerability is to system availability.(CVE-2021-20277)\r\n\r\nA flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.(CVE-2020-27840)","status":"published","published":"2021-06-07T11:04:26Z","modified":"2026-08-18T01:15:32.37472602Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:52:38.987987Z"},{"id":"UBUNTU-CVE-2020-27840","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN), while supposed to be ignored, can cause invalid DN strings with spaces to instead write a zero-byte into out-of-bounds memory, resulting in a crash. The highest threat from this vulnerability is to system availability.","status":"published","published":"2021-03-24T00:00:00Z","modified":"2026-04-22T12:38:38.880055Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:24.541803Z"},{"id":"DLA-2611-1","title":"ldb - security update","status":"published","published":"2021-03-31T00:00:00Z","modified":"2026-03-09T01:23:38.664435Z","updated_at":"2026-11-02T15:46:10.712745Z"},{"id":"DSA-4884-1","title":"ldb - security update","status":"published","published":"2021-04-02T00:00:00Z","modified":"2026-03-09T02:08:57.150374Z","updated_at":"2026-11-02T15:46:17.19998Z"},{"id":"MGASA-2021-0287","title":"Updated samba and ldb packages fix security vulnerabilities","description":"A flaw was found in samba. Spaces used in a string around a domain name (DN),\nwhile supposed to be ignored, can cause invalid DN strings with spaces to\ninstead write a zero-byte into out-of-bounds memory, resulting in a crash.\nThe highest threat from this vulnerability is to system availability\n(CVE-2020-27840).\n\nA flaw was found in samba. The Samba smbd file server must map Windows group\nidentities (SIDs) into unix group ids (gids). The code that performs this had\na flaw that could allow it to read data beyond the end of the array in the\ncase where a negative cache entry had been added to the mapping cache. This\ncould cause the calling code to return those values into the process token\nthat stores the group membership for a user. The highest threat from this\nvulnerability is to data confidentiality and integrity (CVE-2021-20254).\n\nA flaw was found in Samba's libldb. Multiple, consecutive leading spaces in\nan LDAP attribute can lead to an out-of-bounds memory write, leading to a\ncrash of the LDAP server process handling the request. The highest threat\nfrom this vulnerability is to system availability (CVE-2021-20277).\n\nAlso, the samba package for Mageia 7 fixes a scriplet issue when updating.\n\nAdditionally, the sssd package has been rebuilt for the updated ldb package.\n","status":"published","published":"2021-06-25T14:43:41Z","modified":"2026-04-16T04:42:06.130199043Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"openSUSE-SU-2021:0469-1","title":"Security update for ldb","description":"This update for ldb fixes the following issues:\n\n- CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n- CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-03-25T08:10:39Z","modified":"2026-02-04T03:24:48.382489Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:0636-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n- CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).\n- CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n- Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).\n- s3-libads: use dns name to open a ldap session (bsc#1184310).\n- Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).\n\nThis update was imported from the SUSE:SLE-15-SP2:Update update project.","status":"published","published":"2021-04-30T19:22:58Z","modified":"2026-02-04T02:51:51.09837Z","updated_at":"2026-11-02T16:58:31.879684Z"},{"id":"openSUSE-SU-2021:3187-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n- CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).\n- CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n\n- Spec file fixes around systemd and requires (bsc#1182830)\n- Fix dependency problem upgrading from libndr0 to libndr1 (bsc#1189875)\n- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2 (bsc#1189875)\n","status":"published","published":"2021-09-22T13:09:42Z","modified":"2025-05-07T18:12:01.183053Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2022:0283-1","title":"Security update for samba","description":"\n\n- CVE-2021-44141: Information leak via symlinks of existance of\n  files or directories outside of the exported share; (bso#14911);\n  (bsc#1193690);\n- CVE-2021-44142: Out-of-bounds heap read/write vulnerability\n  in VFS module vfs_fruit allows code execution; (bso#14914);\n  (bsc#1194859);\n- CVE-2022-0336: Samba AD users with permission to write to an\n  account can impersonate arbitrary services; (bso#14950);\n  (bsc#1195048);\n\nsamba was updated to 4.15.4 (jsc#SLE-23329);\n\n* Duplicate SMB file_ids leading to Windows client cache\n  poisoning; (bso#14928);\n* Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -\n  NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);\n* kill_tcp_connections does not work; (bso#14934);\n* Can't connect to Windows shares not requiring authentication\n  using KDE/Gnome; (bso#14935);\n* smbclient -L doesn't set 'client max protocol' to NT1 before\n  calling the 'Reconnecting with SMB1 for workgroup listing'\n  path; (bso#14939);\n* Cross device copy of the crossrename module always fails;\n  (bso#14940);\n* symlinkat function from VFS cap module always fails with an\n  error; (bso#14941);\n* Fix possible fsp pointer deference; (bso#14942);\n* Missing pop_sec_ctx() in error path inside close_directory();\n  (bso#14944);\n* 'smbd --build-options' no longer works without an smb.conf file;\n  (bso#14945);\n\nSamba was updated to version 4.15.3 \n\n+ CVE-2021-43566: Symlink race error can allow directory creation\n  outside of the exported share; (bsc#1139519);\n+ CVE-2021-20316: Symlink race error can allow metadata read and\n  modify outside of the exported share; (bsc#1191227);\n- Reorganize libs packages. Split samba-libs into samba-client-libs,\n  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba\n  public libraries depending on internal samba libraries into these\n  packages as there were dependency problems everytime one of these\n  public libraries changed its version (bsc#1192684). The devel\n  packages are merged into samba-devel.\n- Rename package samba-core-devel to samba-devel\n- Update the symlink create by samba-dsdb-modules to private samba\n  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to\n  /usr/lib64/ldb2/modules/ldb/samba\n\nkrb5 was updated to 1.16.3 to 1.19.2\n\n* Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222);\n* Fix a memory leak when gss_inquire_cred() is called without a credential handle.\n\nChanges from 1.19.1:\n\n* Fix a linking issue with Samba.\n* Better support multiple pkinit_identities values by checking whether\n  certificates can be loaded for each value.\n\nChanges from 1.19\n\nAdministrator experience\n  * When a client keytab is present, the GSSAPI krb5 mech will refresh\n    credentials even if the current credentials were acquired manually.\n  * It is now harder to accidentally delete the K/M entry from a KDB.\nDeveloper experience\n  * gss_acquire_cred_from() now supports the 'password' and 'verify'\n    options, allowing credentials to be acquired via password and\n    verified using a keytab key.\n  * When an application accepts a GSS security context, the new\n    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor\n    both provided matching channel bindings.\n  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests\n    to identify the desired client principal by certificate.\n  * PKINIT certauth modules can now cause the hw-authent flag to be set\n    in issued tickets.\n  * The krb5_init_creds_step() API will now issue the same password\n    expiration warnings as krb5_get_init_creds_password().\nProtocol evolution\n  * Added client and KDC support for Microsoft's Resource-Based Constrained\n    Delegation, which allows cross-realm S4U2Proxy requests. A third-party\n    database module is required for KDC support.\n  * kadmin/admin is now the preferred server principal name for kadmin\n    connections, and the host-based form is no longer created by default.\n    The client will still try the host-based form as a fallback.\n  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT\n    extension, which causes channel bindings to be required for the\n    initiator if the acceptor provided them. The client will send this\n    option if the client_aware_gss_bindings profile option is set.\nUser experience\n  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is\n    used in the reply. This encryption type will be deprecated and removed\n    in future releases.\n  * Added kvno flags --out-cache, --no-store, and --cached-only\n    (inspired by Heimdal's kgetcred).\n\nChanges from 1.18.3\n* Fix a denial of service vulnerability when decoding Kerberos\n  protocol messages.\n* Fix a locking issue with the LMDB KDB module which could cause\n  KDC and kadmind processes to lose access to the database.\n* Fix an assertion failure when libgssapi_krb5 is repeatedly loaded\n  and unloaded while libkrb5support remains loaded.\n\nChanges from 1.18.2\n* Fix a SPNEGO regression where an acceptor using the default credential\n  would improperly filter mechanisms, causing a negotiation failure.\n* Fix a bug where the KDC would fail to issue tickets if the local krbtgt\n  principal's first key has a single-DES enctype.\n* Add stub functions to allow old versions of OpenSSL libcrypto to link\n  against libkrb5.\n* Fix a NegoEx bug where the client name and delegated credential might\n  not be reported.\n\nChanges from 1.18.1\n* Fix a crash when qualifying short hostnames when the system has\n  no primary DNS domain.\n* Fix a regression when an application imports 'service@' as a GSS\n  host-based name for its acceptor credential handle.\n* Fix KDC enforcement of auth indicators when they are modified by\n  the KDB module.\n* Fix removal of require_auth string attributes when the LDAP KDB\n  module is used.\n* Fix a compile error when building with musl libc on Linux.\n* Fix a compile error when building with gcc 4.x.\n* Change the KDC constrained delegation precedence order for consistency\n  with Windows KDCs.\n\nChanges from 1.18\nAdministrator experience:\n  * Remove support for single-DES encryption types.\n  * Change the replay cache format to be more efficient and robust.\n    Replay cache filenames using the new format end with '.rcache2'\n    by default.\n  * setuid programs will automatically ignore environment variables\n    that normally affect krb5 API functions, even if the caller does\n    not use krb5_init_secure_context().\n  * Add an 'enforce_ok_as_delegate' krb5.conf relation to disable\n    credential forwarding during GSSAPI authentication unless the KDC\n    sets the ok-as-delegate bit in the service ticket.\n  * Use the permitted_enctypes krb5.conf setting as the default value\n    for default_tkt_enctypes and default_tgs_enctypes.\nDeveloper experience:\n  * Implement krb5_cc_remove_cred() for all credential cache types.\n  * Add the krb5_pac_get_client_info() API to get the client account\n    name from a PAC.\nProtocol evolution:\n  * Add KDC support for S4U2Self requests where the user is identified\n    by X.509 certificate. (Requires support for certificate lookup from\n    a third-party KDB module.)\n  * Remove support for an old ('draft 9') variant of PKINIT.\n  * Add support for Microsoft NegoEx. (Requires one or more third-party\n    GSS modules implementing NegoEx mechanisms.)\nUser experience:\n  * Add support for 'dns_canonicalize_hostname=fallback', causing\n    host-based principal names to be tried first without DNS\n    canonicalization, and again with DNS canonicalization if the\n    un-canonicalized server is not found.\n  * Expand single-component hostnames in host-based principal names\n    when DNS canonicalization is not used, adding the system's first DNS\n    search path as a suffix. Add a 'qualify_shortname' krb5.conf relation\n    to override this suffix or disable expansion.\n  * Honor the transited-policy-checked ticket flag on application servers,\n    eliminating the requirement to configure capaths on servers in some\n    scenarios.\nCode quality:\n  * The libkrb5 serialization code (used to export and import krb5 GSS\n    security contexts) has been simplified and made type-safe.\n  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED\n    messages has been revised to conform to current coding practices.\n  * The test suite has been modified to work with macOS System Integrity\n    Protection enabled.\n  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support\n    can always be tested.\n\nChanges from 1.17.1\n* Fix a bug preventing 'addprinc -randkey -kvno' from working in kadmin.\n* Fix a bug preventing time skew correction from working when a KCM\n  credential cache is used.\n\nChanges from 1.17:\nAdministrator experience:\n* A new Kerberos database module using the Lightning Memory-Mapped\n  Database library (LMDB) has been added.  The LMDB KDB module should\n  be more performant and more robust than the DB2 module, and may\n  become the default module for new databases in a future release.\n* 'kdb5_util dump' will no longer dump policy entries when specific\n  principal names are requested.\nDeveloper experience:\n* The new krb5_get_etype_info() API can be used to retrieve enctype,\n  salt, and string-to-key parameters from the KDC for a client\n  principal.\n* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise\n  principal names to be used with GSS-API functions.\n* KDC and kadmind modules which call com_err() will now write to the\n  log file in a format more consistent with other log messages.\n* Programs which use large numbers of memory credential caches should\n  perform better.\nProtocol evolution:\n* The SPAKE pre-authentication mechanism is now supported.  This\n  mechanism protects against password dictionary attacks without\n  requiring any additional infrastructure such as certificates.  SPAKE\n  is enabled by default on clients, but must be manually enabled on\n  the KDC for this release.\n* PKINIT freshness tokens are now supported.  Freshness tokens can\n  protect against scenarios where an attacker uses temporary access to\n  a smart card to generate authentication requests for the future.\n* Password change operations now prefer TCP over UDP, to avoid\n  spurious error messages about replays when a response packet is\n  dropped.\n* The KDC now supports cross-realm S4U2Self requests when used with a\n  third-party KDB module such as Samba's.  The client code for\n  cross-realm S4U2Self requests is also now more robust.\nUser experience:\n* The new ktutil addent -f flag can be used to fetch salt information\n  from the KDC for password-based keys.\n* The new kdestroy -p option can be used to destroy a credential cache\n  within a collection by client principal name.\n* The Kerberos man page has been restored, and documents the\n  environment variables that affect programs using the Kerberos\n  library.\nCode quality:\n* Python test scripts now use Python 3.\n* Python test scripts now display markers in verbose output, making it\n  easier to find where a failure occurred within the scripts.\n* The Windows build system has been simplified and updated to work\n  with more recent versions of Visual Studio.  A large volume of\n  unused Windows-specific code has been removed.  Visual Studio 2013\n  or later is now required.\n\n- Build with full Cyrus SASL support. Negotiating SASL credentials with\n  an EXTERNAL bind mechanism requires interaction. Kerberos provides its\n  own interaction function that skips all interaction, thus preventing the\n  mechanism from working.\nldb was updated to version 2.4.1 (jsc#SLE-23329);\n\n- Release 2.4.1\n\n  + Corrected python behaviour for 'in' for LDAP attributes\n    contained as part of ldb.Message; (bso#14845);\n  + Fix memory handling in ldb.msg_diff; (bso#14836);\n\n- Release 2.4.0\n\n  + pyldb: Fix Message.items() for a message containing elements\n  + pyldb: Add test for Message.items()\n  + tests: Use ldbsearch '--scope instead of '-s'\n  + Change page size of guidindexpackv1.ldb\n  + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream\n  + attrib_handler casefold: simplify space dropping\n  + fix ldb_comparison_fold off-by-one overrun\n  + CVE-2020-27840: pytests: move Dn.validate test to ldb\n  + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode\n  + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds\n  + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces\n  + improve comments for ldb_module_connect_backend()\n  + test/ldb_tdb: correct introductory comments\n  + ldb.h: remove undefined async_ctx function signatures\n  + correct comments in attrib_handers val_to_int64\n  + dn tests use cmocka print functions\n  + ldb_match: remove redundant check\n  + add tests for ldb_wildcard_compare\n  + ldb_match: trailing chunk must match end of string\n  + pyldb: catch potential overflow error in py_timestring\n  + ldb: remove some 'if PY3's in tests\n\ntalloc was updated to 2.3.3:\n\n+ various bugfixes\n+ python: Ensure reference counts are properly incremented\n+ Change pytalloc source to LGPL\n+ Upgrade waf to 2.0.18 to fix a cross-compilation issue;\n   (bso#13846).\n\ntdb was updated to version 1.4.4:\n\n+ various bugfixes\n\ntevent was updated to version 0.11.0:\n\n+ Add custom tag to events\n+ Add event trace api\n\nsssd was updated to:\n\n- Fix tests test_copy_ccache \u0026 test_copy_keytab for later versions of krb5\n- Update the private ldb modules installation following libldb2 \n  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba\n\napparmor was updated to:\n\n- Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684).\n- add profile for samba-bgqd (bsc#1191532).\n\n","status":"published","published":"2022-02-08T15:10:56Z","modified":"2026-02-04T04:16:05.021402Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:10911-1","title":"ldb-tools-2.3.0-1.3 on GA media","description":"These are all security issues fixed in the ldb-tools-2.3.0-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:37:22.096351Z","updated_at":"2026-11-02T16:58:34.894275Z"},{"id":"openSUSE-SU-2024:11365-1","title":"ctdb-4.14.6+git.182.2205d5224e3-1.1 on GA media","description":"These are all security issues fixed in the ctdb-4.14.6+git.182.2205d5224e3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:49.07167Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"SUSE-SU-2021:0944-1","title":"Security update for ldb","description":"This update for ldb fixes the following issues:\n\n- CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n- CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n","status":"published","published":"2021-03-24T12:42:22Z","modified":"2026-02-04T04:10:24.449244Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:0945-1","title":"Security update for ldb","description":"This update for ldb fixes the following issues:\n\n- CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n- CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n","status":"published","published":"2021-03-24T12:43:13Z","modified":"2026-02-04T03:44:20.540247Z","updated_at":"2026-11-02T15:53:48.690034Z"},{"id":"SUSE-SU-2021:1440-1","title":"Security update for ldb, samba","description":"This update for ldb, samba fixes the following issues:\n\t  \n- ldb was updated to 2.2.1\n   - CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n   - CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).\n   - CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n\n- samba was updated to 4.13.6\n   - CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n   - CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).\n   - CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n   - Spec file fixes around systemd and requires; (bsc#1182830);\n","status":"published","published":"2021-04-29T11:01:45Z","modified":"2026-02-04T03:10:37.120459Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1444-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n- CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).\n- CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n- Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).\n- s3-libads: use dns name to open a ldap session (bsc#1184310).\n- Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).\n","status":"published","published":"2021-04-29T14:17:54Z","modified":"2026-02-04T04:30:01.421562Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:1498-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n- CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).\n- CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n- Avoid free'ing our own pointer in memcache when memcache_trim attempts to reduce cache size (bsc#1179156).\n- s3-libads: use dns name to open a ldap session (bsc#1184310).\n- Adjust smbcacls '--propagate-inheritance' feature to align with upstream (bsc#1178469).\n","status":"published","published":"2021-05-04T15:17:49Z","modified":"2025-05-02T04:30:45.222954Z","updated_at":"2026-11-02T15:53:49.138643Z"},{"id":"SUSE-SU-2021:3187-1","title":"Security update for samba","description":"This update for samba fixes the following issues:\n\n- CVE-2021-20277: Fixed an out of bounds read in ldb_handler_fold (bsc#1183574).\n- CVE-2021-20254: Fixed a buffer overrun in sids_to_unixids() (bsc#1184677).\n- CVE-2020-27840: Fixed an unauthenticated remote heap corruption via bad DNs (bsc#1183572).\n\n- Spec file fixes around systemd and requires (bsc#1182830)\n- Fix dependency problem upgrading from libndr0 to libndr1 (bsc#1189875)\n- Fix dependency problem upgrading from libsmbldap0 to libsmbldap2 (bsc#1189875)\n","status":"published","published":"2021-09-22T13:09:41Z","modified":"2026-02-04T02:14:23.107067Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2022:0283-1","title":"Security update for samba","description":"\n\n- CVE-2021-44141: Information leak via symlinks of existance of\n  files or directories outside of the exported share; (bso#14911);\n  (bsc#1193690);\n- CVE-2021-44142: Out-of-bounds heap read/write vulnerability\n  in VFS module vfs_fruit allows code execution; (bso#14914);\n  (bsc#1194859);\n- CVE-2022-0336: Samba AD users with permission to write to an\n  account can impersonate arbitrary services; (bso#14950);\n  (bsc#1195048);\n\nsamba was updated to 4.15.4 (jsc#SLE-23329);\n\n* Duplicate SMB file_ids leading to Windows client cache\n  poisoning; (bso#14928);\n* Failed to parse NTLMv2_RESPONSE length 95 - Buffer Size Error -\n  NT_STATUS_BUFFER_TOO_SMALL; (bso#14932);\n* kill_tcp_connections does not work; (bso#14934);\n* Can't connect to Windows shares not requiring authentication\n  using KDE/Gnome; (bso#14935);\n* smbclient -L doesn't set 'client max protocol' to NT1 before\n  calling the 'Reconnecting with SMB1 for workgroup listing'\n  path; (bso#14939);\n* Cross device copy of the crossrename module always fails;\n  (bso#14940);\n* symlinkat function from VFS cap module always fails with an\n  error; (bso#14941);\n* Fix possible fsp pointer deference; (bso#14942);\n* Missing pop_sec_ctx() in error path inside close_directory();\n  (bso#14944);\n* 'smbd --build-options' no longer works without an smb.conf file;\n  (bso#14945);\n\nSamba was updated to version 4.15.3 \n\n+ CVE-2021-43566: Symlink race error can allow directory creation\n  outside of the exported share; (bsc#1139519);\n+ CVE-2021-20316: Symlink race error can allow metadata read and\n  modify outside of the exported share; (bsc#1191227);\n- Reorganize libs packages. Split samba-libs into samba-client-libs,\n  samba-libs, samba-winbind-libs and samba-ad-dc-libs, merging samba\n  public libraries depending on internal samba libraries into these\n  packages as there were dependency problems everytime one of these\n  public libraries changed its version (bsc#1192684). The devel\n  packages are merged into samba-devel.\n- Rename package samba-core-devel to samba-devel\n- Update the symlink create by samba-dsdb-modules to private samba\n  ldb modules following libldb2 changes from /usr/lib64/ldb/samba to\n  /usr/lib64/ldb2/modules/ldb/samba\n\nkrb5 was updated to 1.16.3 to 1.19.2\n\n* Fix a denial of service attack against the KDC encrypted challenge code; (CVE-2021-36222);\n* Fix a memory leak when gss_inquire_cred() is called without a credential handle.\n\nChanges from 1.19.1:\n\n* Fix a linking issue with Samba.\n* Better support multiple pkinit_identities values by checking whether\n  certificates can be loaded for each value.\n\nChanges from 1.19\n\nAdministrator experience\n  * When a client keytab is present, the GSSAPI krb5 mech will refresh\n    credentials even if the current credentials were acquired manually.\n  * It is now harder to accidentally delete the K/M entry from a KDB.\nDeveloper experience\n  * gss_acquire_cred_from() now supports the 'password' and 'verify'\n    options, allowing credentials to be acquired via password and\n    verified using a keytab key.\n  * When an application accepts a GSS security context, the new\n    GSS_C_CHANNEL_BOUND_FLAG will be set if the initiator and acceptor\n    both provided matching channel bindings.\n  * Added the GSS_KRB5_NT_X509_CERT name type, allowing S4U2Self requests\n    to identify the desired client principal by certificate.\n  * PKINIT certauth modules can now cause the hw-authent flag to be set\n    in issued tickets.\n  * The krb5_init_creds_step() API will now issue the same password\n    expiration warnings as krb5_get_init_creds_password().\nProtocol evolution\n  * Added client and KDC support for Microsoft's Resource-Based Constrained\n    Delegation, which allows cross-realm S4U2Proxy requests. A third-party\n    database module is required for KDC support.\n  * kadmin/admin is now the preferred server principal name for kadmin\n    connections, and the host-based form is no longer created by default.\n    The client will still try the host-based form as a fallback.\n  * Added client and server support for Microsoft's KERB_AP_OPTIONS_CBT\n    extension, which causes channel bindings to be required for the\n    initiator if the acceptor provided them. The client will send this\n    option if the client_aware_gss_bindings profile option is set.\nUser experience\n  * kinit will now issue a warning if the des3-cbc-sha1 encryption type is\n    used in the reply. This encryption type will be deprecated and removed\n    in future releases.\n  * Added kvno flags --out-cache, --no-store, and --cached-only\n    (inspired by Heimdal's kgetcred).\n\nChanges from 1.18.3\n* Fix a denial of service vulnerability when decoding Kerberos\n  protocol messages.\n* Fix a locking issue with the LMDB KDB module which could cause\n  KDC and kadmind processes to lose access to the database.\n* Fix an assertion failure when libgssapi_krb5 is repeatedly loaded\n  and unloaded while libkrb5support remains loaded.\n\nChanges from 1.18.2\n* Fix a SPNEGO regression where an acceptor using the default credential\n  would improperly filter mechanisms, causing a negotiation failure.\n* Fix a bug where the KDC would fail to issue tickets if the local krbtgt\n  principal's first key has a single-DES enctype.\n* Add stub functions to allow old versions of OpenSSL libcrypto to link\n  against libkrb5.\n* Fix a NegoEx bug where the client name and delegated credential might\n  not be reported.\n\nChanges from 1.18.1\n* Fix a crash when qualifying short hostnames when the system has\n  no primary DNS domain.\n* Fix a regression when an application imports 'service@' as a GSS\n  host-based name for its acceptor credential handle.\n* Fix KDC enforcement of auth indicators when they are modified by\n  the KDB module.\n* Fix removal of require_auth string attributes when the LDAP KDB\n  module is used.\n* Fix a compile error when building with musl libc on Linux.\n* Fix a compile error when building with gcc 4.x.\n* Change the KDC constrained delegation precedence order for consistency\n  with Windows KDCs.\n\nChanges from 1.18\nAdministrator experience:\n  * Remove support for single-DES encryption types.\n  * Change the replay cache format to be more efficient and robust.\n    Replay cache filenames using the new format end with '.rcache2'\n    by default.\n  * setuid programs will automatically ignore environment variables\n    that normally affect krb5 API functions, even if the caller does\n    not use krb5_init_secure_context().\n  * Add an 'enforce_ok_as_delegate' krb5.conf relation to disable\n    credential forwarding during GSSAPI authentication unless the KDC\n    sets the ok-as-delegate bit in the service ticket.\n  * Use the permitted_enctypes krb5.conf setting as the default value\n    for default_tkt_enctypes and default_tgs_enctypes.\nDeveloper experience:\n  * Implement krb5_cc_remove_cred() for all credential cache types.\n  * Add the krb5_pac_get_client_info() API to get the client account\n    name from a PAC.\nProtocol evolution:\n  * Add KDC support for S4U2Self requests where the user is identified\n    by X.509 certificate. (Requires support for certificate lookup from\n    a third-party KDB module.)\n  * Remove support for an old ('draft 9') variant of PKINIT.\n  * Add support for Microsoft NegoEx. (Requires one or more third-party\n    GSS modules implementing NegoEx mechanisms.)\nUser experience:\n  * Add support for 'dns_canonicalize_hostname=fallback', causing\n    host-based principal names to be tried first without DNS\n    canonicalization, and again with DNS canonicalization if the\n    un-canonicalized server is not found.\n  * Expand single-component hostnames in host-based principal names\n    when DNS canonicalization is not used, adding the system's first DNS\n    search path as a suffix. Add a 'qualify_shortname' krb5.conf relation\n    to override this suffix or disable expansion.\n  * Honor the transited-policy-checked ticket flag on application servers,\n    eliminating the requirement to configure capaths on servers in some\n    scenarios.\nCode quality:\n  * The libkrb5 serialization code (used to export and import krb5 GSS\n    security contexts) has been simplified and made type-safe.\n  * The libkrb5 code for creating KRB-PRIV, KRB-SAFE, and KRB-CRED\n    messages has been revised to conform to current coding practices.\n  * The test suite has been modified to work with macOS System Integrity\n    Protection enabled.\n  * The test suite incorporates soft-pkcs11 so that PKINIT PKCS11 support\n    can always be tested.\n\nChanges from 1.17.1\n* Fix a bug preventing 'addprinc -randkey -kvno' from working in kadmin.\n* Fix a bug preventing time skew correction from working when a KCM\n  credential cache is used.\n\nChanges from 1.17:\nAdministrator experience:\n* A new Kerberos database module using the Lightning Memory-Mapped\n  Database library (LMDB) has been added.  The LMDB KDB module should\n  be more performant and more robust than the DB2 module, and may\n  become the default module for new databases in a future release.\n* 'kdb5_util dump' will no longer dump policy entries when specific\n  principal names are requested.\nDeveloper experience:\n* The new krb5_get_etype_info() API can be used to retrieve enctype,\n  salt, and string-to-key parameters from the KDC for a client\n  principal.\n* The new GSS_KRB5_NT_ENTERPRISE_NAME name type allows enterprise\n  principal names to be used with GSS-API functions.\n* KDC and kadmind modules which call com_err() will now write to the\n  log file in a format more consistent with other log messages.\n* Programs which use large numbers of memory credential caches should\n  perform better.\nProtocol evolution:\n* The SPAKE pre-authentication mechanism is now supported.  This\n  mechanism protects against password dictionary attacks without\n  requiring any additional infrastructure such as certificates.  SPAKE\n  is enabled by default on clients, but must be manually enabled on\n  the KDC for this release.\n* PKINIT freshness tokens are now supported.  Freshness tokens can\n  protect against scenarios where an attacker uses temporary access to\n  a smart card to generate authentication requests for the future.\n* Password change operations now prefer TCP over UDP, to avoid\n  spurious error messages about replays when a response packet is\n  dropped.\n* The KDC now supports cross-realm S4U2Self requests when used with a\n  third-party KDB module such as Samba's.  The client code for\n  cross-realm S4U2Self requests is also now more robust.\nUser experience:\n* The new ktutil addent -f flag can be used to fetch salt information\n  from the KDC for password-based keys.\n* The new kdestroy -p option can be used to destroy a credential cache\n  within a collection by client principal name.\n* The Kerberos man page has been restored, and documents the\n  environment variables that affect programs using the Kerberos\n  library.\nCode quality:\n* Python test scripts now use Python 3.\n* Python test scripts now display markers in verbose output, making it\n  easier to find where a failure occurred within the scripts.\n* The Windows build system has been simplified and updated to work\n  with more recent versions of Visual Studio.  A large volume of\n  unused Windows-specific code has been removed.  Visual Studio 2013\n  or later is now required.\n\n- Build with full Cyrus SASL support. Negotiating SASL credentials with\n  an EXTERNAL bind mechanism requires interaction. Kerberos provides its\n  own interaction function that skips all interaction, thus preventing the\n  mechanism from working.\nldb was updated to version 2.4.1 (jsc#SLE-23329);\n\n- Release 2.4.1\n\n  + Corrected python behaviour for 'in' for LDAP attributes\n    contained as part of ldb.Message; (bso#14845);\n  + Fix memory handling in ldb.msg_diff; (bso#14836);\n\n- Release 2.4.0\n\n  + pyldb: Fix Message.items() for a message containing elements\n  + pyldb: Add test for Message.items()\n  + tests: Use ldbsearch '--scope instead of '-s'\n  + Change page size of guidindexpackv1.ldb\n  + Use a 1MiB lmdb so the test also passes on aarch64 CentOS stream\n  + attrib_handler casefold: simplify space dropping\n  + fix ldb_comparison_fold off-by-one overrun\n  + CVE-2020-27840: pytests: move Dn.validate test to ldb\n  + CVE-2020-27840 ldb_dn: avoid head corruption in ldb_dn_explode\n  + CVE-2021-20277 ldb/attrib_handlers casefold: stay in bounds\n  + CVE-2021-20277 ldb tests: ldb_match tests with extra spaces\n  + improve comments for ldb_module_connect_backend()\n  + test/ldb_tdb: correct introductory comments\n  + ldb.h: remove undefined async_ctx function signatures\n  + correct comments in attrib_handers val_to_int64\n  + dn tests use cmocka print functions\n  + ldb_match: remove redundant check\n  + add tests for ldb_wildcard_compare\n  + ldb_match: trailing chunk must match end of string\n  + pyldb: catch potential overflow error in py_timestring\n  + ldb: remove some 'if PY3's in tests\n\ntalloc was updated to 2.3.3:\n\n+ various bugfixes\n+ python: Ensure reference counts are properly incremented\n+ Change pytalloc source to LGPL\n+ Upgrade waf to 2.0.18 to fix a cross-compilation issue;\n   (bso#13846).\n\ntdb was updated to version 1.4.4:\n\n+ various bugfixes\n\ntevent was updated to version 0.11.0:\n\n+ Add custom tag to events\n+ Add event trace api\n\nsssd was updated to:\n\n- Fix tests test_copy_ccache \u0026 test_copy_keytab for later versions of krb5\n- Update the private ldb modules installation following libldb2 \n  changes from /usr/lib64/ldb/samba to /usr/lib64/ldb2/modules/ldb/samba\n\napparmor was updated to:\n\n- Cater for changes to ldb packaging to allow parallel installation with libldb (bsc#1192684).\n- add profile for samba-bgqd (bsc#1191532).\n\n","status":"published","published":"2022-02-08T15:11:00Z","modified":"2026-02-04T03:48:32.625984Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"USN-4888-1","title":"ldb vulnerabilities","description":"Douglas Bagnall discovered that ldb, when used with Samba, incorrectly\nhandled certain LDAP attributes. A remote attacker could possibly use this\nissue to cause the LDAP server to crash, resulting in a denial of service.\n(CVE-2021-20277)\n\nDouglas Bagnall discovered that ldb, when used with Samba, incorrectly\nhandled certain DN strings. A remote attacker could use this issue to\ncause the LDAP server to crash, resulting in a denial of service, or\npossibly execute arbitrary code. (CVE-2020-27840)\n","status":"published","published":"2021-03-24T18:08:35Z","modified":"2026-04-22T10:14:20.442377Z","updated_at":"2026-11-02T16:58:15.159055Z"},{"id":"USN-4888-2","title":"ldb vulnerabilities","description":"USN-4888-1 fixed several vulnerabilities in ldb. This update provides\nthe corresponding update for Ubuntu 14.04 ESM.\n\nOriginal advisory details:\n\n Douglas Bagnall discovered that ldb, when used with Samba, incorrectly\n handled certain LDAP attributes. A remote attacker could possibly use this\n issue to cause the LDAP server to crash, resulting in a denial of service.\n (CVE-2021-20277)\n \n Douglas Bagnall discovered that ldb, when used with Samba, incorrectly\n handled certain DN strings. A remote attacker could use this issue to\n cause the LDAP server to crash, resulting in a denial of service, or\n possibly execute arbitrary code. (CVE-2020-27840)\n","status":"published","published":"2021-03-25T15:32:21Z","modified":"2026-04-22T10:13:35.728841Z","updated_at":"2026-11-02T16:58:15.159055Z"}]}}